Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

f6b6806a39...fe.exe

windows7-x64

10

f6b6806a39...fe.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 13:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe

  • Size

    72KB

  • MD5

    09af1f83b4fd8208c1432bdce05d939b

  • SHA1

    4a159d62986de3d5ed2ca60fc23995eb316a7f7f

  • SHA256

    f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe

  • SHA512

    dbfdc1864146071b07df8ff4b8bfcbb7cfb01c7dabc1ddd37ff47f55f0dc2f77888c25a2d89b05067d31edefd3d13c7586d79627952ba08653d296d4bf31b2af

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2L:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP/

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe
    "C:\Users\Admin\AppData\Local\Temp\f6b6806a39dd6bc8a5c09869fcddb258c3588ee0a126fc7feaef164bf5e375fe.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\1746280505\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1746280505\backup.exe C:\Users\Admin\AppData\Local\Temp\1746280505\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1780
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:688
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1088
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1636
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1924
          • C:\Program Files\7-Zip\System Restore.exe
            "C:\Program Files\7-Zip\System Restore.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1196
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1216
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1192
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:980
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1764
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1916
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1952
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:856
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1356
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1180
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1508
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2036
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1468
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1028
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1896
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1936
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1836
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1520
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1456
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2008
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1636
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1504
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:844
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:840
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:432
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1440
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2012
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1664
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1484
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1668
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1840
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1396
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1952
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:956
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1076
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1756
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:524
                • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1220
                • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:836
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1016
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1028
                • C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1896
                • C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1936
                • C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1324
                • C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1084
                • C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:596
                • C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1000
                • C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1684
                • C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1792
                • C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:1440
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
                  8⤵
                    PID:796
                  • C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:1264
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Drops file in Program Files directory
                  • System policy modification
                  PID:1588
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:836
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                    8⤵
                      PID:564
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                      8⤵
                      • Disables RegEdit via registry modification
                      PID:984
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                      8⤵
                        PID:960
                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:564
                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                        8⤵
                          PID:1636
                      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                        7⤵
                          PID:1032
                          • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:592
                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                          7⤵
                          • Disables RegEdit via registry modification
                          PID:796
                        • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                          7⤵
                            PID:1696
                          • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                            7⤵
                            • Drops file in Program Files directory
                            PID:1488
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:1836
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              PID:1896
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              PID:872
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:1800
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
                              8⤵
                                PID:1620
                              • C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
                                8⤵
                                  PID:1000
                              • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                7⤵
                                • Disables RegEdit via registry modification
                                PID:1776
                                • C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
                                  8⤵
                                    PID:912
                                  • C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
                                    8⤵
                                      PID:844
                                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
                                      8⤵
                                        PID:2148
                                    • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                      7⤵
                                        PID:1984
                                      • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                        7⤵
                                          PID:1840
                                        • C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                                          7⤵
                                            PID:2164
                                        • C:\Program Files\Common Files\Services\backup.exe
                                          "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System policy modification
                                          PID:1572
                                        • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                          "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                          6⤵
                                          • Drops file in Program Files directory
                                          PID:1740
                                          • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                            "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            PID:1676
                                        • C:\Program Files\Common Files\System\backup.exe
                                          "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Drops file in Program Files directory
                                          • System policy modification
                                          PID:1664
                                          • C:\Program Files\Common Files\System\ado\backup.exe
                                            "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                            7⤵
                                            • Drops file in Program Files directory
                                            • System policy modification
                                            PID:1220
                                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                              "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                              8⤵
                                                PID:1196
                                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                PID:1900
                                              • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                8⤵
                                                • Disables RegEdit via registry modification
                                                • System policy modification
                                                PID:1744
                                              • C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe
                                                "C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System policy modification
                                                PID:1740
                                              • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System policy modification
                                                PID:1588
                                              • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                8⤵
                                                  PID:1268
                                              • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                7⤵
                                                  PID:1952
                                                • C:\Program Files\Common Files\System\en-US\backup.exe
                                                  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                  7⤵
                                                    PID:848
                                                  • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                    "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                    7⤵
                                                      PID:1708
                                                    • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                      "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                      7⤵
                                                        PID:2072
                                                      • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                        7⤵
                                                          PID:2476
                                                    • C:\Program Files\DVD Maker\backup.exe
                                                      "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                      5⤵
                                                      • Drops file in Program Files directory
                                                      PID:1712
                                                      • C:\Program Files\DVD Maker\de-DE\backup.exe
                                                        "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                                        6⤵
                                                        • Disables RegEdit via registry modification
                                                        PID:316
                                                      • C:\Program Files\DVD Maker\en-US\backup.exe
                                                        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                        6⤵
                                                        • Disables RegEdit via registry modification
                                                        PID:840
                                                      • C:\Program Files\DVD Maker\es-ES\data.exe
                                                        "C:\Program Files\DVD Maker\es-ES\data.exe" C:\Program Files\DVD Maker\es-ES\
                                                        6⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        PID:876
                                                      • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                        "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                        6⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        PID:1624
                                                      • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                        "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                        6⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        PID:1440
                                                      • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                        "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                        6⤵
                                                        • System policy modification
                                                        PID:872
                                                      • C:\Program Files\DVD Maker\Shared\backup.exe
                                                        "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                        6⤵
                                                        • System policy modification
                                                        PID:300
                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                          7⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Drops file in Program Files directory
                                                          PID:556
                                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
                                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
                                                            8⤵
                                                              PID:1748
                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
                                                              8⤵
                                                                PID:432
                                                              • C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
                                                                "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
                                                                8⤵
                                                                  PID:1376
                                                                • C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
                                                                  "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
                                                                  8⤵
                                                                    PID:1712
                                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
                                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
                                                                    8⤵
                                                                      PID:1684
                                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
                                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
                                                                      8⤵
                                                                        PID:2120
                                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
                                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
                                                                        8⤵
                                                                          PID:2452
                                                                  • C:\Program Files\Google\backup.exe
                                                                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                    5⤵
                                                                    • Drops file in Program Files directory
                                                                    PID:1292
                                                                    • C:\Program Files\Google\Chrome\backup.exe
                                                                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      • Drops file in Program Files directory
                                                                      PID:1140
                                                                      • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                        7⤵
                                                                        • Drops file in Program Files directory
                                                                        • System policy modification
                                                                        PID:1404
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • Drops file in Program Files directory
                                                                          PID:1076
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:300
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • System policy modification
                                                                            PID:1764
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:1504
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                            9⤵
                                                                              PID:916
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              PID:1296
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                              9⤵
                                                                                PID:1836
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                9⤵
                                                                                  PID:1452
                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                  9⤵
                                                                                    PID:1508
                                                                                • C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
                                                                                  8⤵
                                                                                    PID:1940
                                                                                  • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                    8⤵
                                                                                      PID:1296
                                                                              • C:\Program Files\Internet Explorer\backup.exe
                                                                                "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                5⤵
                                                                                • Drops file in Program Files directory
                                                                                PID:2012
                                                                                • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                  6⤵
                                                                                    PID:1972
                                                                                  • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                    "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                    6⤵
                                                                                      PID:840
                                                                                    • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                      "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                      6⤵
                                                                                        PID:1972
                                                                                      • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                        6⤵
                                                                                          PID:1292
                                                                                        • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                          "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                          6⤵
                                                                                            PID:2104
                                                                                          • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                            "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                            6⤵
                                                                                              PID:2432
                                                                                          • C:\Program Files\Java\backup.exe
                                                                                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                            5⤵
                                                                                              PID:1128
                                                                                            • C:\Program Files\Microsoft Games\backup.exe
                                                                                              "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                                              5⤵
                                                                                                PID:1136
                                                                                                • C:\Program Files\Microsoft Games\Chess\backup.exe
                                                                                                  "C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
                                                                                                  6⤵
                                                                                                    PID:1236
                                                                                                  • C:\Program Files\Microsoft Games\FreeCell\backup.exe
                                                                                                    "C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\
                                                                                                    6⤵
                                                                                                      PID:2096
                                                                                                    • C:\Program Files\Microsoft Games\Hearts\backup.exe
                                                                                                      "C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
                                                                                                      6⤵
                                                                                                        PID:2484
                                                                                                    • C:\Program Files\Microsoft Office\backup.exe
                                                                                                      "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                      5⤵
                                                                                                        PID:1636
                                                                                                      • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                        5⤵
                                                                                                          PID:2128
                                                                                                      • C:\Program Files (x86)\data.exe
                                                                                                        "C:\Program Files (x86)\data.exe" C:\Program Files (x86)\
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:1088
                                                                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                          5⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:1036
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                                            6⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            • System policy modification
                                                                                                            PID:1316
                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                                              7⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System policy modification
                                                                                                              PID:472
                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                                              7⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:1516
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                                                8⤵
                                                                                                                • System policy modification
                                                                                                                PID:1972
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                                                8⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                PID:1376
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                                                8⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • System policy modification
                                                                                                                PID:1184
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                                                8⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • System policy modification
                                                                                                                PID:1936
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                                                                  9⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:928
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                                                8⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                PID:568
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                                                                8⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:1932
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
                                                                                                                  9⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • System policy modification
                                                                                                                  PID:592
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                                                                8⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                PID:1552
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                                                                8⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                • System policy modification
                                                                                                                PID:876
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
                                                                                                                  9⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  PID:1136
                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
                                                                                                                    10⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    PID:1676
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\System Restore.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
                                                                                                                  9⤵
                                                                                                                    PID:700
                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
                                                                                                                      10⤵
                                                                                                                        PID:1036
                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
                                                                                                                      9⤵
                                                                                                                        PID:1400
                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
                                                                                                                        9⤵
                                                                                                                          PID:2064
                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                                                        8⤵
                                                                                                                          PID:880
                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                                                          8⤵
                                                                                                                            PID:1140
                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\update.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                                                            8⤵
                                                                                                                              PID:2172
                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                                            7⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • System policy modification
                                                                                                                            PID:1040
                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                                                                              8⤵
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:1028
                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System Restore.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
                                                                                                                                9⤵
                                                                                                                                  PID:1584
                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\data.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
                                                                                                                                8⤵
                                                                                                                                • System policy modification
                                                                                                                                PID:1484
                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
                                                                                                                                8⤵
                                                                                                                                • System policy modification
                                                                                                                                PID:1376
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
                                                                                                                                  9⤵
                                                                                                                                    PID:1468
                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
                                                                                                                                    9⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:1268
                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
                                                                                                                                      10⤵
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      PID:1620
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
                                                                                                                                        11⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        PID:840
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
                                                                                                                                  8⤵
                                                                                                                                    PID:1796
                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
                                                                                                                                    8⤵
                                                                                                                                      PID:964
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
                                                                                                                                        9⤵
                                                                                                                                          PID:836
                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                                                      7⤵
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • System policy modification
                                                                                                                                      PID:1984
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
                                                                                                                                        8⤵
                                                                                                                                          PID:1000
                                                                                                                                  • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                    5⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    PID:1180
                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                      6⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • System policy modification
                                                                                                                                      PID:1708
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                        7⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        • System policy modification
                                                                                                                                        PID:268
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                                                                                                        7⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        PID:2012
                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
                                                                                                                                          8⤵
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • System policy modification
                                                                                                                                          PID:528
                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
                                                                                                                                            9⤵
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            PID:780
                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
                                                                                                                                              10⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              PID:1028
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
                                                                                                                                        7⤵
                                                                                                                                        • System policy modification
                                                                                                                                        PID:1972
                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe AIR\update.exe
                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                                                      6⤵
                                                                                                                                        PID:1764
                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
                                                                                                                                          7⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          PID:1504
                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
                                                                                                                                            8⤵
                                                                                                                                              PID:1360
                                                                                                                                        • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                                                                          6⤵
                                                                                                                                            PID:1932
                                                                                                                                          • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                                                                            6⤵
                                                                                                                                              PID:1764
                                                                                                                                              • C:\Program Files (x86)\Common Files\microsoft shared\DAO\update.exe
                                                                                                                                                "C:\Program Files (x86)\Common Files\microsoft shared\DAO\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\
                                                                                                                                                7⤵
                                                                                                                                                  PID:2008
                                                                                                                                                • C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\
                                                                                                                                                  7⤵
                                                                                                                                                    PID:2088
                                                                                                                                                  • C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\
                                                                                                                                                    7⤵
                                                                                                                                                      PID:2440
                                                                                                                                                  • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                    6⤵
                                                                                                                                                      PID:316
                                                                                                                                                    • C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
                                                                                                                                                      6⤵
                                                                                                                                                        PID:2112
                                                                                                                                                      • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                        6⤵
                                                                                                                                                          PID:2492
                                                                                                                                                      • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                        5⤵
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:1016
                                                                                                                                                        • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                          6⤵
                                                                                                                                                            PID:848
                                                                                                                                                          • C:\Program Files (x86)\Google\Policies\update.exe
                                                                                                                                                            "C:\Program Files (x86)\Google\Policies\update.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                            6⤵
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            PID:1964
                                                                                                                                                          • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                            6⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            PID:528
                                                                                                                                                          • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                            6⤵
                                                                                                                                                              PID:1504
                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                            5⤵
                                                                                                                                                              PID:1720
                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:2508
                                                                                                                                                              • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:320
                                                                                                                                                                • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:908
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:2156
                                                                                                                                                                  • C:\Users\backup.exe
                                                                                                                                                                    C:\Users\backup.exe C:\Users\
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:956
                                                                                                                                                                    • C:\Users\Admin\backup.exe
                                                                                                                                                                      C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      • System policy modification
                                                                                                                                                                      PID:1652
                                                                                                                                                                      • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                        6⤵
                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                        PID:700
                                                                                                                                                                      • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:1480
                                                                                                                                                                        • C:\Users\Admin\Documents\data.exe
                                                                                                                                                                          C:\Users\Admin\Documents\data.exe C:\Users\Admin\Documents\
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                          PID:1916
                                                                                                                                                                        • C:\Users\Admin\Downloads\System Restore.exe
                                                                                                                                                                          "C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:1744
                                                                                                                                                                          • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                            C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:472
                                                                                                                                                                            • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                              C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:928
                                                                                                                                                                              • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                PID:1968
                                                                                                                                                                              • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:1952
                                                                                                                                                                                • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                  "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                  PID:1448
                                                                                                                                                                                • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                  C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:536
                                                                                                                                                                                  • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                    C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:1572
                                                                                                                                                                                  • C:\Users\Public\backup.exe
                                                                                                                                                                                    C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:300
                                                                                                                                                                                  • C:\Windows\System Restore.exe
                                                                                                                                                                                    "C:\Windows\System Restore.exe" C:\Windows\
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:524
                                                                                                                                                                                    • C:\Windows\addins\backup.exe
                                                                                                                                                                                      C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      PID:1648
                                                                                                                                                                                    • C:\Windows\AppCompat\backup.exe
                                                                                                                                                                                      C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:916
                                                                                                                                                                                      • C:\Windows\AppPatch\backup.exe
                                                                                                                                                                                        C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:872
                                                                                                                                                                                        • C:\Windows\assembly\backup.exe
                                                                                                                                                                                          C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:1124
                                                                                                                                                                                          • C:\Windows\Branding\backup.exe
                                                                                                                                                                                            C:\Windows\Branding\backup.exe C:\Windows\Branding\
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:1040
                                                                                                                                                                                            • C:\Windows\CSC\backup.exe
                                                                                                                                                                                              C:\Windows\CSC\backup.exe C:\Windows\CSC\
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:2080
                                                                                                                                                                                              • C:\Windows\Cursors\backup.exe
                                                                                                                                                                                                C:\Windows\Cursors\backup.exe C:\Windows\Cursors\
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:2460
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:912
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:1736
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:1184
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:2036
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:836
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:552

                                                                                                                                                                                        Network

                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                        Downloads

                                                                                                                                                                                        • C:\PerfLogs\Admin\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          6203aa06584a8b0b18d4e2708a77de5a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4318b75c4c33aa3fca1d9186bce1e537daca82fa

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\PerfLogs\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ec207e3f86d2883c4b508ee80148cd1c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1e77013a0b4d2d1c919a1fbc801c936f658f9509

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\PerfLogs\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ec207e3f86d2883c4b508ee80148cd1c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1e77013a0b4d2d1c919a1fbc801c936f658f9509

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          f2aa8c9e4d36b1a4b901cf6516536d7b

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          bf7b44ea3a988b1d14ad815cc4efb10226fbfdd8

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          7d514f23a9f18cf2fdbbebdd87aa312ddcde45b1a16450cd6b1bc31a6d91fdcb

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          dab2e84b2334c5dce8c6cc36ec21b4733743c739ba7e6a772dd740eb3ce3cb31447c248c25ada326fa53011a535e6bb1d94b946b00f2ecfe1652718e55d0f939

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\7-Zip\System Restore.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          6203aa06584a8b0b18d4e2708a77de5a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4318b75c4c33aa3fca1d9186bce1e537daca82fa

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\7-Zip\System Restore.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          6203aa06584a8b0b18d4e2708a77de5a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4318b75c4c33aa3fca1d9186bce1e537daca82fa

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fcf6885968b135564e44dc353a335dfe

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          af38fa1b6bea4b4d8bf21101c963cab53bff2762

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          09a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          9e44e482e6cd5a829738ed6ef0833af8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          ea2eb54360226f6d1c36b51e839dfb0e0164bf1a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          e43c02880d3c5838e5e2c15b613022bc97b855c8fefbed8f1a2c94edb264e331

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          783c267f97d92c868c938cb33214a6e4e03e53911976d0bf37591e4c8252758642b93fedd73f3497b72b40ceed6ed033aa43b9c8f7aaa8d2aef13fc4a14ec914

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          9e44e482e6cd5a829738ed6ef0833af8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          ea2eb54360226f6d1c36b51e839dfb0e0164bf1a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          e43c02880d3c5838e5e2c15b613022bc97b855c8fefbed8f1a2c94edb264e331

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          783c267f97d92c868c938cb33214a6e4e03e53911976d0bf37591e4c8252758642b93fedd73f3497b72b40ceed6ed033aa43b9c8f7aaa8d2aef13fc4a14ec914

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          145e7fce208d824fe1c0b382a3542c4a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          60104a30d18d8cf71bae0cc9628686c7a54ac0c9

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fcf6885968b135564e44dc353a335dfe

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          af38fa1b6bea4b4d8bf21101c963cab53bff2762

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          09a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fcf6885968b135564e44dc353a335dfe

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          af38fa1b6bea4b4d8bf21101c963cab53bff2762

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          09a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          145e7fce208d824fe1c0b382a3542c4a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          60104a30d18d8cf71bae0cc9628686c7a54ac0c9

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          30a8ac1c8ca66633d27725653f757ef8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          c031a3a5fd5ac5ef0d4860b0ad71461850290a8a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          20336b911b8bba7edc3b84fbb64cc7a54c9e96618c74bb4e025b637b47563bb4

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          288681f7a6a5075f84e5eb59009d368c701fbb71be2393e9bd95fcde719fad91d9a9f671b87e68f87a9e76278ccbd46c2ac7e678d1c1d14cf06fd1bba07c1720

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          30a8ac1c8ca66633d27725653f757ef8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          c031a3a5fd5ac5ef0d4860b0ad71461850290a8a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          20336b911b8bba7edc3b84fbb64cc7a54c9e96618c74bb4e025b637b47563bb4

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          288681f7a6a5075f84e5eb59009d368c701fbb71be2393e9bd95fcde719fad91d9a9f671b87e68f87a9e76278ccbd46c2ac7e678d1c1d14cf06fd1bba07c1720

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ec207e3f86d2883c4b508ee80148cd1c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1e77013a0b4d2d1c919a1fbc801c936f658f9509

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Program Files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ec207e3f86d2883c4b508ee80148cd1c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1e77013a0b4d2d1c919a1fbc801c936f658f9509

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1746280505\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          3d8bc47e64283ffbd405ef7de31bb6e8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          b9efa91ce21a0af1d60dd81fe97b100937a45279

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          b523634025fcc59d55cec11edec1b02d04660fb94ea74c69d13c794a69169765

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          52d6270f3c2bd9d71168d808e415cf3c2636ebf8e406772802cb88b620b75b4c2c16a72f27b263cb13528600f32a16a1e1ee1542357700df35c845fd190465b8

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1746280505\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          3d8bc47e64283ffbd405ef7de31bb6e8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          b9efa91ce21a0af1d60dd81fe97b100937a45279

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          b523634025fcc59d55cec11edec1b02d04660fb94ea74c69d13c794a69169765

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          52d6270f3c2bd9d71168d808e415cf3c2636ebf8e406772802cb88b620b75b4c2c16a72f27b263cb13528600f32a16a1e1ee1542357700df35c845fd190465b8

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          9e75479ed82be2349e692e8e51d97a41

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          2c2f34d2135c88863c30ee23358d4e99f9672673

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          27008a457950afbb928ae77643187c67ca41ba7e714f21b4c6c09eafa3d66bfb

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          c639918554d0d95069b51ac8e98f425d18ba4b5ec631a581d0609432f5156543f2ac4cb73e720f629011d329901b23c970a07dbf15978bc4c67253f3270cd6fe

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • C:\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          9e75479ed82be2349e692e8e51d97a41

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          2c2f34d2135c88863c30ee23358d4e99f9672673

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          27008a457950afbb928ae77643187c67ca41ba7e714f21b4c6c09eafa3d66bfb

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          c639918554d0d95069b51ac8e98f425d18ba4b5ec631a581d0609432f5156543f2ac4cb73e720f629011d329901b23c970a07dbf15978bc4c67253f3270cd6fe

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \PerfLogs\Admin\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          6203aa06584a8b0b18d4e2708a77de5a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4318b75c4c33aa3fca1d9186bce1e537daca82fa

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \PerfLogs\Admin\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          6203aa06584a8b0b18d4e2708a77de5a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4318b75c4c33aa3fca1d9186bce1e537daca82fa

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \PerfLogs\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ec207e3f86d2883c4b508ee80148cd1c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1e77013a0b4d2d1c919a1fbc801c936f658f9509

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \PerfLogs\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ec207e3f86d2883c4b508ee80148cd1c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1e77013a0b4d2d1c919a1fbc801c936f658f9509

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          f2aa8c9e4d36b1a4b901cf6516536d7b

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          bf7b44ea3a988b1d14ad815cc4efb10226fbfdd8

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          7d514f23a9f18cf2fdbbebdd87aa312ddcde45b1a16450cd6b1bc31a6d91fdcb

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          dab2e84b2334c5dce8c6cc36ec21b4733743c739ba7e6a772dd740eb3ce3cb31447c248c25ada326fa53011a535e6bb1d94b946b00f2ecfe1652718e55d0f939

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          f2aa8c9e4d36b1a4b901cf6516536d7b

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          bf7b44ea3a988b1d14ad815cc4efb10226fbfdd8

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          7d514f23a9f18cf2fdbbebdd87aa312ddcde45b1a16450cd6b1bc31a6d91fdcb

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          dab2e84b2334c5dce8c6cc36ec21b4733743c739ba7e6a772dd740eb3ce3cb31447c248c25ada326fa53011a535e6bb1d94b946b00f2ecfe1652718e55d0f939

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\7-Zip\System Restore.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          6203aa06584a8b0b18d4e2708a77de5a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4318b75c4c33aa3fca1d9186bce1e537daca82fa

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\7-Zip\System Restore.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          6203aa06584a8b0b18d4e2708a77de5a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          4318b75c4c33aa3fca1d9186bce1e537daca82fa

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d8fa470aa9bc3c5066c3289cb78c9fcbb1e1da37a8c49018336ecae27b5d0a02

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6146a84f7d07b8f2d63da2ce09fec7abab1f2556125b38907e05a4271da703a52c25bfb15daf0cc4f5e745c943e2606db2c9d5449fb284be2564089ac2f54798

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fcf6885968b135564e44dc353a335dfe

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          af38fa1b6bea4b4d8bf21101c963cab53bff2762

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          09a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fcf6885968b135564e44dc353a335dfe

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          af38fa1b6bea4b4d8bf21101c963cab53bff2762

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          09a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          9e44e482e6cd5a829738ed6ef0833af8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          ea2eb54360226f6d1c36b51e839dfb0e0164bf1a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          e43c02880d3c5838e5e2c15b613022bc97b855c8fefbed8f1a2c94edb264e331

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          783c267f97d92c868c938cb33214a6e4e03e53911976d0bf37591e4c8252758642b93fedd73f3497b72b40ceed6ed033aa43b9c8f7aaa8d2aef13fc4a14ec914

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          9e44e482e6cd5a829738ed6ef0833af8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          ea2eb54360226f6d1c36b51e839dfb0e0164bf1a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          e43c02880d3c5838e5e2c15b613022bc97b855c8fefbed8f1a2c94edb264e331

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          783c267f97d92c868c938cb33214a6e4e03e53911976d0bf37591e4c8252758642b93fedd73f3497b72b40ceed6ed033aa43b9c8f7aaa8d2aef13fc4a14ec914

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          145e7fce208d824fe1c0b382a3542c4a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          60104a30d18d8cf71bae0cc9628686c7a54ac0c9

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          145e7fce208d824fe1c0b382a3542c4a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          60104a30d18d8cf71bae0cc9628686c7a54ac0c9

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fcf6885968b135564e44dc353a335dfe

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          af38fa1b6bea4b4d8bf21101c963cab53bff2762

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          09a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          fcf6885968b135564e44dc353a335dfe

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          af38fa1b6bea4b4d8bf21101c963cab53bff2762

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d593d2038bc09008e947313e33a52d0f6092fefaa89e4f2fa2ccf5979b91889c

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          09a52fde98f2481e8a6a2b54617ea5b21752dde84342d2c1c8a10913417b7495069e571400b0abcfd9fcc8c04aeb909c83699999ad137c98a6ea94bd0d1efd9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          145e7fce208d824fe1c0b382a3542c4a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          60104a30d18d8cf71bae0cc9628686c7a54ac0c9

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          145e7fce208d824fe1c0b382a3542c4a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          60104a30d18d8cf71bae0cc9628686c7a54ac0c9

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          145e7fce208d824fe1c0b382a3542c4a

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          60104a30d18d8cf71bae0cc9628686c7a54ac0c9

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          ccd2fa96ec302c372715a88ad40306c8012ff8b8072e8e6ead697dbac2a9b82d

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          6315286fb0906888f194ff5e285b9ae4a1cd6a3c11b02b6cce7a9e9987a4402a406b70690b5045c9f4861e12b5abd7d27e8113113815c7b14b8c8ddf4cc62f9b

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          30a8ac1c8ca66633d27725653f757ef8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          c031a3a5fd5ac5ef0d4860b0ad71461850290a8a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          20336b911b8bba7edc3b84fbb64cc7a54c9e96618c74bb4e025b637b47563bb4

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          288681f7a6a5075f84e5eb59009d368c701fbb71be2393e9bd95fcde719fad91d9a9f671b87e68f87a9e76278ccbd46c2ac7e678d1c1d14cf06fd1bba07c1720

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\Common Files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          30a8ac1c8ca66633d27725653f757ef8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          c031a3a5fd5ac5ef0d4860b0ad71461850290a8a

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          20336b911b8bba7edc3b84fbb64cc7a54c9e96618c74bb4e025b637b47563bb4

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          288681f7a6a5075f84e5eb59009d368c701fbb71be2393e9bd95fcde719fad91d9a9f671b87e68f87a9e76278ccbd46c2ac7e678d1c1d14cf06fd1bba07c1720

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ec207e3f86d2883c4b508ee80148cd1c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1e77013a0b4d2d1c919a1fbc801c936f658f9509

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Program Files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          ec207e3f86d2883c4b508ee80148cd1c

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          1e77013a0b4d2d1c919a1fbc801c936f658f9509

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          d5f4665b30cb481b6d47fee5795c75d924f33ef75bd9cb48e71360116a8a840b

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          ab1fdeaef6dde0abab7a458c51a92f2ffcda4ed7ffb751d6f35ec647187fdaf5081c0b30e5e043a13250ea0bee24124feb8a049eca01e0645e9d68b480621be6

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\1746280505\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          3d8bc47e64283ffbd405ef7de31bb6e8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          b9efa91ce21a0af1d60dd81fe97b100937a45279

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          b523634025fcc59d55cec11edec1b02d04660fb94ea74c69d13c794a69169765

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          52d6270f3c2bd9d71168d808e415cf3c2636ebf8e406772802cb88b620b75b4c2c16a72f27b263cb13528600f32a16a1e1ee1542357700df35c845fd190465b8

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\1746280505\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          3d8bc47e64283ffbd405ef7de31bb6e8

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          b9efa91ce21a0af1d60dd81fe97b100937a45279

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          b523634025fcc59d55cec11edec1b02d04660fb94ea74c69d13c794a69169765

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          52d6270f3c2bd9d71168d808e415cf3c2636ebf8e406772802cb88b620b75b4c2c16a72f27b263cb13528600f32a16a1e1ee1542357700df35c845fd190465b8

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                          Filesize

                                                                                                                                                                                          72KB

                                                                                                                                                                                          MD5

                                                                                                                                                                                          d13c74050558b1d1c90609dfbbe18dbf

                                                                                                                                                                                          SHA1

                                                                                                                                                                                          898b2574ac8b182ac46efd4c23ecc708102f0495

                                                                                                                                                                                          SHA256

                                                                                                                                                                                          f00e4d75596a839fcc74f642bcc0069d192da2d4adcb330ebc64c5cebae70a46

                                                                                                                                                                                          SHA512

                                                                                                                                                                                          9fb2895d40d3eea553ef70ea4c86d6d221fa2d7a05959da0f7557ec0aaf1643dc9d669c0797efb9df3190efe8febd2659950e29f1e65d80594a2767d89f99a4d

                                                                                                                                                                                          Download Submit

                                                                                                                                                                                        • memory/1492-210-0x00000000745F1000-0x00000000745F3000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          8KB

                                                                                                                                                                                          Download

                                                                                                                                                                                        • memory/1492-103-0x0000000075B11000-0x0000000075B13000-memory.dmp

                                                                                                                                                                                          Filesize

                                                                                                                                                                                          8KB

                                                                                                                                                                                          Download