Overview

overview

10

Static

static

666f674364...5f.exe

windows7-x64

10

666f674364...5f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    187s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 14:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    666f674364ddbb97e42abfdfef409df6a20e31f19f4774bff67c53319d3b415f.exe

  • Size

    72KB

  • MD5

    023a658cfb8d8203512470df841d0042

  • SHA1

    4a62d3825e28ca7766eac007a896ca0a840667c4

  • SHA256

    666f674364ddbb97e42abfdfef409df6a20e31f19f4774bff67c53319d3b415f

  • SHA512

    3bcc3ab50c6d3409d6c9f3b6125e55f8262b5685edc8414fdfe40f0047b634d31a9cb0d169edb78b8b3a6e480bab7b07d4740d02ade7ef279c00e280aafe8093

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2f:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPL

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\666f674364ddbb97e42abfdfef409df6a20e31f19f4774bff67c53319d3b415f.exe
    "C:\Users\Admin\AppData\Local\Temp\666f674364ddbb97e42abfdfef409df6a20e31f19f4774bff67c53319d3b415f.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3756
    • C:\Users\Admin\AppData\Local\Temp\2002634683\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2002634683\backup.exe C:\Users\Admin\AppData\Local\Temp\2002634683\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4884
      • C:\data.exe
        \data.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:556
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1780
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4196
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:224
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1616
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2208
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3596
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3676
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1864
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:4480
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:832
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4524
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1940
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3372
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2344
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2000
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4576
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3892
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1312
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3264
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4592
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4408
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4824
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1588
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2200
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:3868
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2764
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2472
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\update.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3228
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:972
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:752
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1460
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:396
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2880
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4556
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2496
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:380
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4656
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1516
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4616
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1444
                • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2940
                • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3972
                • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4020
                • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3448
                • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4868
                • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3456
                • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5064
                • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4704
                • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1116
                • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3368
                • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1044
                • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2704
                • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5036
                • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                  8⤵
                    PID:3524
                  • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:1884
                  • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                    8⤵
                      PID:2468
                    • C:\Program Files\Common Files\microsoft shared\ink\th-TH\data.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\th-TH\data.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                      8⤵
                      • System policy modification
                      PID:1816
                    • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                      8⤵
                        PID:1892
                      • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\System Restore.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:3664
                      • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                        8⤵
                          PID:3612
                        • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                          8⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:4012
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                        7⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        PID:1792
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                          8⤵
                          • Disables RegEdit via registry modification
                          PID:3400
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                          8⤵
                            PID:3460
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                            8⤵
                            • Disables RegEdit via registry modification
                            • System policy modification
                            PID:4888
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                            8⤵
                              PID:2492
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                              8⤵
                              • Disables RegEdit via registry modification
                              PID:4608
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:2880
                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                            7⤵
                              PID:100
                              • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • System policy modification
                                PID:1092
                            • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                              7⤵
                              • Disables RegEdit via registry modification
                              PID:60
                            • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                              7⤵
                              • System policy modification
                              PID:2936
                            • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                              7⤵
                                PID:4720
                              • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                PID:1340
                                • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                  8⤵
                                    PID:2840
                                • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                  7⤵
                                    PID:2096
                                    • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:4900
                                  • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:1644
                                  • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:4416
                                  • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                    7⤵
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:928
                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                      8⤵
                                      • System policy modification
                                      PID:1952
                                      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                        9⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        PID:1300
                                • C:\Program Files\Common Files\Services\backup.exe
                                  "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4308
                                • C:\Program Files\Common Files\System\backup.exe
                                  "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                  6⤵
                                  • Drops file in Program Files directory
                                  PID:3572
                                  • C:\Program Files\Common Files\System\ado\backup.exe
                                    "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                    7⤵
                                      PID:3120
                                      • C:\Program Files\Common Files\System\ado\de-DE\data.exe
                                        "C:\Program Files\Common Files\System\ado\de-DE\data.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                        8⤵
                                          PID:3992
                                        • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                          "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                          8⤵
                                            PID:4580
                                          • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                            "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                            8⤵
                                              PID:2764
                                            • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                              "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              PID:748
                                            • C:\Program Files\Common Files\System\ado\it-IT\data.exe
                                              "C:\Program Files\Common Files\System\ado\it-IT\data.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                              8⤵
                                              • Disables RegEdit via registry modification
                                              PID:4712
                                            • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                              "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                              8⤵
                                              • Disables RegEdit via registry modification
                                              • System policy modification
                                              PID:440
                                          • C:\Program Files\Common Files\System\de-DE\backup.exe
                                            "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                            7⤵
                                              PID:4828
                                            • C:\Program Files\Common Files\System\en-US\backup.exe
                                              "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                              7⤵
                                                PID:1140
                                              • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:3532
                                              • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                7⤵
                                                • System policy modification
                                                PID:3980
                                              • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                7⤵
                                                • System policy modification
                                                PID:1312
                                              • C:\Program Files\Common Files\System\ja-JP\update.exe
                                                "C:\Program Files\Common Files\System\ja-JP\update.exe" C:\Program Files\Common Files\System\ja-JP\
                                                7⤵
                                                • System policy modification
                                                PID:4692
                                              • C:\Program Files\Common Files\System\msadc\backup.exe
                                                "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                7⤵
                                                • Disables RegEdit via registry modification
                                                • Drops file in Program Files directory
                                                PID:1696
                                                • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                  8⤵
                                                    PID:4832
                                                  • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    PID:2704
                                                  • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                    "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    PID:2208
                                                  • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                    "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                    8⤵
                                                      PID:3828
                                                    • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                      "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                      8⤵
                                                        PID:4192
                                                      • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                        "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                        8⤵
                                                          PID:2436
                                                      • C:\Program Files\Common Files\System\Ole DB\data.exe
                                                        "C:\Program Files\Common Files\System\Ole DB\data.exe" C:\Program Files\Common Files\System\Ole DB\
                                                        7⤵
                                                        • Disables RegEdit via registry modification
                                                        • Drops file in Program Files directory
                                                        PID:4316
                                                        • C:\Program Files\Common Files\System\Ole DB\de-DE\update.exe
                                                          "C:\Program Files\Common Files\System\Ole DB\de-DE\update.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                          8⤵
                                                            PID:888
                                                          • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                            "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                            8⤵
                                                              PID:4608
                                                            • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                              "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                              8⤵
                                                                PID:3124
                                                        • C:\Program Files\Google\backup.exe
                                                          "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                          5⤵
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          PID:208
                                                          • C:\Program Files\Google\Chrome\update.exe
                                                            "C:\Program Files\Google\Chrome\update.exe" C:\Program Files\Google\Chrome\
                                                            6⤵
                                                            • Drops file in Program Files directory
                                                            • System policy modification
                                                            PID:3316
                                                            • C:\Program Files\Google\Chrome\Application\backup.exe
                                                              "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                              7⤵
                                                                PID:1976
                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\data.exe
                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                  8⤵
                                                                  • Drops file in Program Files directory
                                                                  PID:1812
                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                    9⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • System policy modification
                                                                    PID:1004
                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                    9⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    PID:1268
                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                    9⤵
                                                                    • System policy modification
                                                                    PID:436
                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                    9⤵
                                                                      PID:3936
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                      9⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      PID:3640
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                      9⤵
                                                                      • System policy modification
                                                                      PID:4240
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                      9⤵
                                                                        PID:2384
                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                        9⤵
                                                                        • Disables RegEdit via registry modification
                                                                        • Drops file in Program Files directory
                                                                        PID:4936
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                          10⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Drops file in Program Files directory
                                                                          PID:3216
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                            11⤵
                                                                              PID:1572
                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                            10⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:1864
                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                            10⤵
                                                                              PID:1448
                                                                        • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                          8⤵
                                                                            PID:5048
                                                                    • C:\Program Files\Internet Explorer\backup.exe
                                                                      "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                      5⤵
                                                                      • Drops file in Program Files directory
                                                                      PID:2204
                                                                      • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                        "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                        6⤵
                                                                          PID:1620
                                                                        • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                          "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                          6⤵
                                                                          • System policy modification
                                                                          PID:3796
                                                                        • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                          "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                          6⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System policy modification
                                                                          PID:1480
                                                                        • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                          "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                          6⤵
                                                                            PID:4376
                                                                          • C:\Program Files\Internet Explorer\images\System Restore.exe
                                                                            "C:\Program Files\Internet Explorer\images\System Restore.exe" C:\Program Files\Internet Explorer\images\
                                                                            6⤵
                                                                              PID:2284
                                                                            • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                              "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                              6⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              PID:2592
                                                                            • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                              "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                              6⤵
                                                                              • System policy modification
                                                                              PID:2312
                                                                            • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                              "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                              6⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • System policy modification
                                                                              PID:2140
                                                                          • C:\Program Files\Java\backup.exe
                                                                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                            5⤵
                                                                              PID:1588
                                                                              • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                                "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                6⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                PID:3804
                                                                                • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                  7⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  PID:3524
                                                                                • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                  7⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Drops file in Program Files directory
                                                                                  PID:1268
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                    8⤵
                                                                                    • Drops file in Program Files directory
                                                                                    PID:2596
                                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                      9⤵
                                                                                        PID:2708
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                    7⤵
                                                                                    • System policy modification
                                                                                    PID:4936
                                                                            • C:\Program Files (x86)\backup.exe
                                                                              "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                              4⤵
                                                                              • Drops file in Program Files directory
                                                                              PID:4196
                                                                              • C:\Program Files (x86)\Adobe\data.exe
                                                                                "C:\Program Files (x86)\Adobe\data.exe" C:\Program Files (x86)\Adobe\
                                                                                5⤵
                                                                                • Drops file in Program Files directory
                                                                                PID:3676
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                  6⤵
                                                                                  • Drops file in Program Files directory
                                                                                  PID:1820
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                    7⤵
                                                                                      PID:2000
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\System Restore.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                      7⤵
                                                                                      • Drops file in Program Files directory
                                                                                      • System policy modification
                                                                                      PID:3712
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                        8⤵
                                                                                          PID:1508
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                            9⤵
                                                                                            • System policy modification
                                                                                            PID:1588
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                          8⤵
                                                                                            PID:940
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\System Restore.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                              9⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:2212
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                            8⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            • System policy modification
                                                                                            PID:1388
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                            8⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            PID:5116
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                            8⤵
                                                                                              PID:3692
                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\System Restore.exe
                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                9⤵
                                                                                                  PID:1844
                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                8⤵
                                                                                                • Drops file in Program Files directory
                                                                                                PID:4464
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                  9⤵
                                                                                                    PID:4920
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                  8⤵
                                                                                                    PID:4328
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                    8⤵
                                                                                                    • Drops file in Program Files directory
                                                                                                    • System policy modification
                                                                                                    PID:2496
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                      9⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:4044
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                    8⤵
                                                                                                      PID:4336
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                        9⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:4720
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                          10⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          PID:1108
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                        9⤵
                                                                                                          PID:3560
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                        8⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        • System policy modification
                                                                                                        PID:3044
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                      7⤵
                                                                                                      • Drops file in Program Files directory
                                                                                                      PID:3156
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                        8⤵
                                                                                                        • System policy modification
                                                                                                        PID:3200
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                          9⤵
                                                                                                          • System policy modification
                                                                                                          PID:4776
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                        8⤵
                                                                                                        • System policy modification
                                                                                                        PID:2408
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                        8⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        PID:2844
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                          9⤵
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • Drops file in Program Files directory
                                                                                                          • System policy modification
                                                                                                          PID:3952
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                            10⤵
                                                                                                              PID:632
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                              10⤵
                                                                                                                PID:4020
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                  11⤵
                                                                                                                    PID:4548
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                    11⤵
                                                                                                                      PID:840
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                      11⤵
                                                                                                                        PID:3040
                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                7⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                • System policy modification
                                                                                                                PID:2472
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                  8⤵
                                                                                                                    PID:3340
                                                                                                            • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                              "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                              5⤵
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:3456
                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                6⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:3736
                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                  7⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  • System policy modification
                                                                                                                  PID:1888
                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                  7⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:996
                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                    8⤵
                                                                                                                      PID:4888
                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                    7⤵
                                                                                                                      PID:3916
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                        8⤵
                                                                                                                          PID:1944
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                        7⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        PID:3676
                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\System Restore.exe
                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                          8⤵
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          PID:2860
                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                            9⤵
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:4540
                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                              10⤵
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              PID:1572
                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                              10⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:1228
                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                                                11⤵
                                                                                                                                  PID:1444
                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                                                    12⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    PID:4716
                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
                                                                                                                                      13⤵
                                                                                                                                        PID:1236
                                                                                                                        • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                          "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                          6⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:708
                                                                                                                          • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                            "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                            7⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • System policy modification
                                                                                                                            PID:2972
                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                          6⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:2096
                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                            7⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            PID:1948
                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                            7⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • System policy modification
                                                                                                                            PID:4344
                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                            7⤵
                                                                                                                              PID:4840
                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\data.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                8⤵
                                                                                                                                  PID:436
                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                  8⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  PID:3492
                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                  8⤵
                                                                                                                                    PID:1292
                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
                                                                                                                                    8⤵
                                                                                                                                      PID:3692
                                                                                                                              • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                5⤵
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                PID:3600
                                                                                                                                • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                  6⤵
                                                                                                                                    PID:2840
                                                                                                                                  • C:\Program Files (x86)\Google\Policies\System Restore.exe
                                                                                                                                    "C:\Program Files (x86)\Google\Policies\System Restore.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                    6⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    PID:1140
                                                                                                                                  • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                    6⤵
                                                                                                                                      PID:3592
                                                                                                                                    • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                      6⤵
                                                                                                                                        PID:3216
                                                                                                                                        • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                          7⤵
                                                                                                                                            PID:392
                                                                                                                                            • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                              8⤵
                                                                                                                                                PID:2164
                                                                                                                                                • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                                                                                                  9⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                  PID:440
                                                                                                                                            • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                              7⤵
                                                                                                                                                PID:5068
                                                                                                                                        • C:\Users\backup.exe
                                                                                                                                          C:\Users\backup.exe C:\Users\
                                                                                                                                          4⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          • System policy modification
                                                                                                                                          PID:3272
                                                                                                                                          • C:\Users\Admin\backup.exe
                                                                                                                                            C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                            5⤵
                                                                                                                                            • System policy modification
                                                                                                                                            PID:3180
                                                                                                                                            • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                              "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                              6⤵
                                                                                                                                              • System policy modification
                                                                                                                                              PID:4636
                                                                                                                                            • C:\Users\Admin\Contacts\System Restore.exe
                                                                                                                                              "C:\Users\Admin\Contacts\System Restore.exe" C:\Users\Admin\Contacts\
                                                                                                                                              6⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                              PID:4424
                                                                                                                                            • C:\Users\Admin\Desktop\data.exe
                                                                                                                                              C:\Users\Admin\Desktop\data.exe C:\Users\Admin\Desktop\
                                                                                                                                              6⤵
                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                              PID:5060
                                                                                                                                            • C:\Users\Admin\Documents\backup.exe
                                                                                                                                              C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                              6⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              PID:2108
                                                                                                                                            • C:\Users\Admin\Downloads\System Restore.exe
                                                                                                                                              "C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\
                                                                                                                                              6⤵
                                                                                                                                              • System policy modification
                                                                                                                                              PID:4492
                                                                                                                                            • C:\Users\Admin\Favorites\data.exe
                                                                                                                                              C:\Users\Admin\Favorites\data.exe C:\Users\Admin\Favorites\
                                                                                                                                              6⤵
                                                                                                                                                PID:3580
                                                                                                                                              • C:\Users\Admin\Links\backup.exe
                                                                                                                                                C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                6⤵
                                                                                                                                                • System policy modification
                                                                                                                                                PID:3544
                                                                                                                                              • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                6⤵
                                                                                                                                                  PID:2000
                                                                                                                                                • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                  C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                  6⤵
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:1648
                                                                                                                                                  • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                    "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                    7⤵
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    PID:3528
                                                                                                                                                  • C:\Users\Admin\Pictures\Saved Pictures\System Restore.exe
                                                                                                                                                    "C:\Users\Admin\Pictures\Saved Pictures\System Restore.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                    7⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    PID:3340
                                                                                                                                                • C:\Users\Admin\Music\backup.exe
                                                                                                                                                  C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                  6⤵
                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                  PID:3980
                                                                                                                                                • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                  "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4780
                                                                                                                                                • C:\Users\Public\backup.exe
                                                                                                                                                  C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                  5⤵
                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:2304
                                                                                                                                                  • C:\Users\Public\Documents\backup.exe
                                                                                                                                                    C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                    6⤵
                                                                                                                                                      PID:1108
                                                                                                                                                    • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                      C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                      6⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                      PID:1636
                                                                                                                                                    • C:\Users\Public\Music\backup.exe
                                                                                                                                                      C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                      6⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      PID:4964
                                                                                                                                                    • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                      C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                      6⤵
                                                                                                                                                        PID:1464
                                                                                                                                                      • C:\Users\Public\Videos\backup.exe
                                                                                                                                                        C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                        6⤵
                                                                                                                                                          PID:1088
                                                                                                                                                    • C:\Windows\backup.exe
                                                                                                                                                      C:\Windows\backup.exe C:\Windows\
                                                                                                                                                      4⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:1468
                                                                                                                                                      • C:\Windows\addins\backup.exe
                                                                                                                                                        C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                        5⤵
                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                        PID:1568
                                                                                                                                                      • C:\Windows\appcompat\backup.exe
                                                                                                                                                        C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                        5⤵
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4308
                                                                                                                                                        • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                          C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                          6⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:416
                                                                                                                                                        • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                          C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                          6⤵
                                                                                                                                                            PID:2284
                                                                                                                                                          • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                            C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                            6⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            PID:2280
                                                                                                                                                        • C:\Windows\apppatch\backup.exe
                                                                                                                                                          C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                          5⤵
                                                                                                                                                            PID:1112
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:5076
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:5052
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:4416
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:2032
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                      2⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:1792
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                      2⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:1844
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                    1⤵
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    PID:1524
                                                                                                                                                  • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                    C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                    1⤵
                                                                                                                                                      PID:560
                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                                      1⤵
                                                                                                                                                        PID:808

                                                                                                                                                      Network

                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • C:\PerfLogs\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        bd34966a06dff9296f34be85cb49e81f

                                                                                                                                                        SHA1

                                                                                                                                                        d8f8b3e999ac79eb6c736ddbdcbabe5e385a3163

                                                                                                                                                        SHA256

                                                                                                                                                        70a690487c5a144328b22afff552bbf3bf3c287baf0074bb46c4ce536e908581

                                                                                                                                                        SHA512

                                                                                                                                                        a0ce9b893caaa7671e23b82f2d5f2c31bf4c280bef30ec33033e03b72d16b8e67db89851470b053df017f0616a031a973a3c835805a9bc1ab72f3b8abb612a80

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\PerfLogs\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        bd34966a06dff9296f34be85cb49e81f

                                                                                                                                                        SHA1

                                                                                                                                                        d8f8b3e999ac79eb6c736ddbdcbabe5e385a3163

                                                                                                                                                        SHA256

                                                                                                                                                        70a690487c5a144328b22afff552bbf3bf3c287baf0074bb46c4ce536e908581

                                                                                                                                                        SHA512

                                                                                                                                                        a0ce9b893caaa7671e23b82f2d5f2c31bf4c280bef30ec33033e03b72d16b8e67db89851470b053df017f0616a031a973a3c835805a9bc1ab72f3b8abb612a80

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        ddd186bc1a9bd9925e234a8a437a3120

                                                                                                                                                        SHA1

                                                                                                                                                        6ca092883acf77d3c0945a6cc4e7e7f9e1bad825

                                                                                                                                                        SHA256

                                                                                                                                                        520c173139b32ed8a13fe04412fc610a8ee2c3a9160aeebacb2b8838fafbdbdb

                                                                                                                                                        SHA512

                                                                                                                                                        e0d556e568b882046e778b45f9b12ba72167e8fad57e816a8df570c2948b9eaed0c4eabf732afe6680f794b0f464dd7da3cba8f26757fc2921ea9f997a84576e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        ddd186bc1a9bd9925e234a8a437a3120

                                                                                                                                                        SHA1

                                                                                                                                                        6ca092883acf77d3c0945a6cc4e7e7f9e1bad825

                                                                                                                                                        SHA256

                                                                                                                                                        520c173139b32ed8a13fe04412fc610a8ee2c3a9160aeebacb2b8838fafbdbdb

                                                                                                                                                        SHA512

                                                                                                                                                        e0d556e568b882046e778b45f9b12ba72167e8fad57e816a8df570c2948b9eaed0c4eabf732afe6680f794b0f464dd7da3cba8f26757fc2921ea9f997a84576e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        a37f0afdac3862092196f78b83a969f0

                                                                                                                                                        SHA1

                                                                                                                                                        a1590438e6669c1a05dcc862dacbfea8f7e38635

                                                                                                                                                        SHA256

                                                                                                                                                        0bd30af38f2d844b57125fdbcf5774417ca5b40c955a0cbfb49d4d7517258108

                                                                                                                                                        SHA512

                                                                                                                                                        9370a676f46ff1db2b37deef35b8c5393645e6c3443fc36f5c929671136a4d55fcb3e66fa033a227a593afbc74e104b3dc33811ffb5ea61eff7e21c10f08ab65

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        a37f0afdac3862092196f78b83a969f0

                                                                                                                                                        SHA1

                                                                                                                                                        a1590438e6669c1a05dcc862dacbfea8f7e38635

                                                                                                                                                        SHA256

                                                                                                                                                        0bd30af38f2d844b57125fdbcf5774417ca5b40c955a0cbfb49d4d7517258108

                                                                                                                                                        SHA512

                                                                                                                                                        9370a676f46ff1db2b37deef35b8c5393645e6c3443fc36f5c929671136a4d55fcb3e66fa033a227a593afbc74e104b3dc33811ffb5ea61eff7e21c10f08ab65

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        c4b2c1607f8a27cda3d485e0c99d6de1

                                                                                                                                                        SHA1

                                                                                                                                                        bd713179abfa8b9101af65dc48f4d1ebc7fb13d7

                                                                                                                                                        SHA256

                                                                                                                                                        931c36c3b6271b3ea1580536a72611f2ee8142fe8f8f0389e3b0ec961d8278b3

                                                                                                                                                        SHA512

                                                                                                                                                        bf06e9571f496480b6a92ea379d00a38fe5b427cb5890abcf6b0408846b10a40cb32913ce6ddd4e72c5a28cac77089f276666c331ef52a0bbb540dac387488ea

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        c4b2c1607f8a27cda3d485e0c99d6de1

                                                                                                                                                        SHA1

                                                                                                                                                        bd713179abfa8b9101af65dc48f4d1ebc7fb13d7

                                                                                                                                                        SHA256

                                                                                                                                                        931c36c3b6271b3ea1580536a72611f2ee8142fe8f8f0389e3b0ec961d8278b3

                                                                                                                                                        SHA512

                                                                                                                                                        bf06e9571f496480b6a92ea379d00a38fe5b427cb5890abcf6b0408846b10a40cb32913ce6ddd4e72c5a28cac77089f276666c331ef52a0bbb540dac387488ea

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        8eee65a7bf3b958c488ba1cd1bfa9f48

                                                                                                                                                        SHA1

                                                                                                                                                        9f94761aa8a9e6c3f2c9700c248bd233d6911255

                                                                                                                                                        SHA256

                                                                                                                                                        2e0f0feb0fca2f1e7696735e22fec6f50f22280f0f421af7ac5174a9dfdebecc

                                                                                                                                                        SHA512

                                                                                                                                                        da3131b46b39fe64c33bff6b1e375abc982814fa039defa47c272701b00ff312126669b6501a54d665e07fa17e69bce0b7370f997fe21f66c33ede254077365e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        8eee65a7bf3b958c488ba1cd1bfa9f48

                                                                                                                                                        SHA1

                                                                                                                                                        9f94761aa8a9e6c3f2c9700c248bd233d6911255

                                                                                                                                                        SHA256

                                                                                                                                                        2e0f0feb0fca2f1e7696735e22fec6f50f22280f0f421af7ac5174a9dfdebecc

                                                                                                                                                        SHA512

                                                                                                                                                        da3131b46b39fe64c33bff6b1e375abc982814fa039defa47c272701b00ff312126669b6501a54d665e07fa17e69bce0b7370f997fe21f66c33ede254077365e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        9295a33efb39fa5f0c81cc555f85c25e

                                                                                                                                                        SHA1

                                                                                                                                                        98a33c72afc7b652df7e4657e99fe676636cf770

                                                                                                                                                        SHA256

                                                                                                                                                        de0f32b9a9847b1b2feafbf7f71681fbef5f831b7cf8a40a3eb8d779972937f4

                                                                                                                                                        SHA512

                                                                                                                                                        ef5ce0554be642b82164ad5fcc6d67f5d8f414d43853ebfe7d45e2ca3c54c55a7399b008c265beff749c147526232658fbd2be12e2ffa640c96ef8b9dc6c07a4

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        9295a33efb39fa5f0c81cc555f85c25e

                                                                                                                                                        SHA1

                                                                                                                                                        98a33c72afc7b652df7e4657e99fe676636cf770

                                                                                                                                                        SHA256

                                                                                                                                                        de0f32b9a9847b1b2feafbf7f71681fbef5f831b7cf8a40a3eb8d779972937f4

                                                                                                                                                        SHA512

                                                                                                                                                        ef5ce0554be642b82164ad5fcc6d67f5d8f414d43853ebfe7d45e2ca3c54c55a7399b008c265beff749c147526232658fbd2be12e2ffa640c96ef8b9dc6c07a4

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        c4b2c1607f8a27cda3d485e0c99d6de1

                                                                                                                                                        SHA1

                                                                                                                                                        bd713179abfa8b9101af65dc48f4d1ebc7fb13d7

                                                                                                                                                        SHA256

                                                                                                                                                        931c36c3b6271b3ea1580536a72611f2ee8142fe8f8f0389e3b0ec961d8278b3

                                                                                                                                                        SHA512

                                                                                                                                                        bf06e9571f496480b6a92ea379d00a38fe5b427cb5890abcf6b0408846b10a40cb32913ce6ddd4e72c5a28cac77089f276666c331ef52a0bbb540dac387488ea

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        c4b2c1607f8a27cda3d485e0c99d6de1

                                                                                                                                                        SHA1

                                                                                                                                                        bd713179abfa8b9101af65dc48f4d1ebc7fb13d7

                                                                                                                                                        SHA256

                                                                                                                                                        931c36c3b6271b3ea1580536a72611f2ee8142fe8f8f0389e3b0ec961d8278b3

                                                                                                                                                        SHA512

                                                                                                                                                        bf06e9571f496480b6a92ea379d00a38fe5b427cb5890abcf6b0408846b10a40cb32913ce6ddd4e72c5a28cac77089f276666c331ef52a0bbb540dac387488ea

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        9295a33efb39fa5f0c81cc555f85c25e

                                                                                                                                                        SHA1

                                                                                                                                                        98a33c72afc7b652df7e4657e99fe676636cf770

                                                                                                                                                        SHA256

                                                                                                                                                        de0f32b9a9847b1b2feafbf7f71681fbef5f831b7cf8a40a3eb8d779972937f4

                                                                                                                                                        SHA512

                                                                                                                                                        ef5ce0554be642b82164ad5fcc6d67f5d8f414d43853ebfe7d45e2ca3c54c55a7399b008c265beff749c147526232658fbd2be12e2ffa640c96ef8b9dc6c07a4

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        9295a33efb39fa5f0c81cc555f85c25e

                                                                                                                                                        SHA1

                                                                                                                                                        98a33c72afc7b652df7e4657e99fe676636cf770

                                                                                                                                                        SHA256

                                                                                                                                                        de0f32b9a9847b1b2feafbf7f71681fbef5f831b7cf8a40a3eb8d779972937f4

                                                                                                                                                        SHA512

                                                                                                                                                        ef5ce0554be642b82164ad5fcc6d67f5d8f414d43853ebfe7d45e2ca3c54c55a7399b008c265beff749c147526232658fbd2be12e2ffa640c96ef8b9dc6c07a4

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        f103db920082efc549dee889157f87ae

                                                                                                                                                        SHA1

                                                                                                                                                        7d26197ab7eeeaca8a04a7326232e6b727be95fd

                                                                                                                                                        SHA256

                                                                                                                                                        4fa7b8fc8571bb58ca9baa37228c098dbef2f065501acd5131440f80f7c571f3

                                                                                                                                                        SHA512

                                                                                                                                                        5b1f55657e38c1b47907c7fcd8b69e193f0b90cbc97b79655c7eff404432f073a07278d11edd61164e20a7d2eb08f801da5950079c52c14bb4fe9f39fea0b178

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-ES\System Restore.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-ES\System Restore.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        096ba43f7cda3698c82e120caab23c38

                                                                                                                                                        SHA1

                                                                                                                                                        1a63da7ed1d263c5e4efc7f523eaf379bb067790

                                                                                                                                                        SHA256

                                                                                                                                                        5a60abf990944ec9b057de56ecf88035fb60de345dff0acbe4da6f15f537102d

                                                                                                                                                        SHA512

                                                                                                                                                        0c0609bbef5b4e464ab154056a54ddd22fcfb093f9040fa507fc73a7918b541c96d1149981e55fe1e440f5434977693922aedda57bbdad56d6c989a4b1d40c72

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        12299d34c8cf266424a10632f6d25238

                                                                                                                                                        SHA1

                                                                                                                                                        da652d2028b07706e30176b16a53072cd9b24fa6

                                                                                                                                                        SHA256

                                                                                                                                                        4051d1205627d8174e2ad811e928ff4dd68cc1347ebb89394d04e3aa3f2676d9

                                                                                                                                                        SHA512

                                                                                                                                                        503070e659bd0bfbf3cb094f391b5bff9148f843c9f0944413419eda07e38de5e582e2523289348c3eb6f77abce44fc517923d65afb329fd351ad2d972add72a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        12299d34c8cf266424a10632f6d25238

                                                                                                                                                        SHA1

                                                                                                                                                        da652d2028b07706e30176b16a53072cd9b24fa6

                                                                                                                                                        SHA256

                                                                                                                                                        4051d1205627d8174e2ad811e928ff4dd68cc1347ebb89394d04e3aa3f2676d9

                                                                                                                                                        SHA512

                                                                                                                                                        503070e659bd0bfbf3cb094f391b5bff9148f843c9f0944413419eda07e38de5e582e2523289348c3eb6f77abce44fc517923d65afb329fd351ad2d972add72a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        12299d34c8cf266424a10632f6d25238

                                                                                                                                                        SHA1

                                                                                                                                                        da652d2028b07706e30176b16a53072cd9b24fa6

                                                                                                                                                        SHA256

                                                                                                                                                        4051d1205627d8174e2ad811e928ff4dd68cc1347ebb89394d04e3aa3f2676d9

                                                                                                                                                        SHA512

                                                                                                                                                        503070e659bd0bfbf3cb094f391b5bff9148f843c9f0944413419eda07e38de5e582e2523289348c3eb6f77abce44fc517923d65afb329fd351ad2d972add72a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        12299d34c8cf266424a10632f6d25238

                                                                                                                                                        SHA1

                                                                                                                                                        da652d2028b07706e30176b16a53072cd9b24fa6

                                                                                                                                                        SHA256

                                                                                                                                                        4051d1205627d8174e2ad811e928ff4dd68cc1347ebb89394d04e3aa3f2676d9

                                                                                                                                                        SHA512

                                                                                                                                                        503070e659bd0bfbf3cb094f391b5bff9148f843c9f0944413419eda07e38de5e582e2523289348c3eb6f77abce44fc517923d65afb329fd351ad2d972add72a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        12299d34c8cf266424a10632f6d25238

                                                                                                                                                        SHA1

                                                                                                                                                        da652d2028b07706e30176b16a53072cd9b24fa6

                                                                                                                                                        SHA256

                                                                                                                                                        4051d1205627d8174e2ad811e928ff4dd68cc1347ebb89394d04e3aa3f2676d9

                                                                                                                                                        SHA512

                                                                                                                                                        503070e659bd0bfbf3cb094f391b5bff9148f843c9f0944413419eda07e38de5e582e2523289348c3eb6f77abce44fc517923d65afb329fd351ad2d972add72a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        12299d34c8cf266424a10632f6d25238

                                                                                                                                                        SHA1

                                                                                                                                                        da652d2028b07706e30176b16a53072cd9b24fa6

                                                                                                                                                        SHA256

                                                                                                                                                        4051d1205627d8174e2ad811e928ff4dd68cc1347ebb89394d04e3aa3f2676d9

                                                                                                                                                        SHA512

                                                                                                                                                        503070e659bd0bfbf3cb094f391b5bff9148f843c9f0944413419eda07e38de5e582e2523289348c3eb6f77abce44fc517923d65afb329fd351ad2d972add72a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        bd34966a06dff9296f34be85cb49e81f

                                                                                                                                                        SHA1

                                                                                                                                                        d8f8b3e999ac79eb6c736ddbdcbabe5e385a3163

                                                                                                                                                        SHA256

                                                                                                                                                        70a690487c5a144328b22afff552bbf3bf3c287baf0074bb46c4ce536e908581

                                                                                                                                                        SHA512

                                                                                                                                                        a0ce9b893caaa7671e23b82f2d5f2c31bf4c280bef30ec33033e03b72d16b8e67db89851470b053df017f0616a031a973a3c835805a9bc1ab72f3b8abb612a80

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Program Files\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        bd34966a06dff9296f34be85cb49e81f

                                                                                                                                                        SHA1

                                                                                                                                                        d8f8b3e999ac79eb6c736ddbdcbabe5e385a3163

                                                                                                                                                        SHA256

                                                                                                                                                        70a690487c5a144328b22afff552bbf3bf3c287baf0074bb46c4ce536e908581

                                                                                                                                                        SHA512

                                                                                                                                                        a0ce9b893caaa7671e23b82f2d5f2c31bf4c280bef30ec33033e03b72d16b8e67db89851470b053df017f0616a031a973a3c835805a9bc1ab72f3b8abb612a80

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2002634683\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        0dfd14b2d9434f96aed2bc69f5c2439f

                                                                                                                                                        SHA1

                                                                                                                                                        9a991e42fe4515668cc24c19f08da3dd4c1b205d

                                                                                                                                                        SHA256

                                                                                                                                                        4e768723d50be3c44b2218b6723da917ac33db0952264255f21605578319efc8

                                                                                                                                                        SHA512

                                                                                                                                                        13119e06dca5ec9ace09c7b7ccee3d1c339336ffe8b70f440fc1dc04bd70b706d182369612795a9eb7273d7cf43244742ecde7906e23655461bc757a92e69f82

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2002634683\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        0dfd14b2d9434f96aed2bc69f5c2439f

                                                                                                                                                        SHA1

                                                                                                                                                        9a991e42fe4515668cc24c19f08da3dd4c1b205d

                                                                                                                                                        SHA256

                                                                                                                                                        4e768723d50be3c44b2218b6723da917ac33db0952264255f21605578319efc8

                                                                                                                                                        SHA512

                                                                                                                                                        13119e06dca5ec9ace09c7b7ccee3d1c339336ffe8b70f440fc1dc04bd70b706d182369612795a9eb7273d7cf43244742ecde7906e23655461bc757a92e69f82

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        5ffede4b0d09a4e2f5b63d4c1363e8b8

                                                                                                                                                        SHA1

                                                                                                                                                        ce45f3558b08fe54661cff5d6c2dd91e301c5124

                                                                                                                                                        SHA256

                                                                                                                                                        bc02304cb2cc42ac437af1d47ec0aa8793ea8977a92245045302d914dc975afb

                                                                                                                                                        SHA512

                                                                                                                                                        cf744bd8d91e2d6814b413898a336546086abd3d721885f35271b0210dff3805ca1f621350dba30b254c1afe732b7342c22c5f1a3219431d063599abcdb626a7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        5ffede4b0d09a4e2f5b63d4c1363e8b8

                                                                                                                                                        SHA1

                                                                                                                                                        ce45f3558b08fe54661cff5d6c2dd91e301c5124

                                                                                                                                                        SHA256

                                                                                                                                                        bc02304cb2cc42ac437af1d47ec0aa8793ea8977a92245045302d914dc975afb

                                                                                                                                                        SHA512

                                                                                                                                                        cf744bd8d91e2d6814b413898a336546086abd3d721885f35271b0210dff3805ca1f621350dba30b254c1afe732b7342c22c5f1a3219431d063599abcdb626a7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        5ffede4b0d09a4e2f5b63d4c1363e8b8

                                                                                                                                                        SHA1

                                                                                                                                                        ce45f3558b08fe54661cff5d6c2dd91e301c5124

                                                                                                                                                        SHA256

                                                                                                                                                        bc02304cb2cc42ac437af1d47ec0aa8793ea8977a92245045302d914dc975afb

                                                                                                                                                        SHA512

                                                                                                                                                        cf744bd8d91e2d6814b413898a336546086abd3d721885f35271b0210dff3805ca1f621350dba30b254c1afe732b7342c22c5f1a3219431d063599abcdb626a7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        5ffede4b0d09a4e2f5b63d4c1363e8b8

                                                                                                                                                        SHA1

                                                                                                                                                        ce45f3558b08fe54661cff5d6c2dd91e301c5124

                                                                                                                                                        SHA256

                                                                                                                                                        bc02304cb2cc42ac437af1d47ec0aa8793ea8977a92245045302d914dc975afb

                                                                                                                                                        SHA512

                                                                                                                                                        cf744bd8d91e2d6814b413898a336546086abd3d721885f35271b0210dff3805ca1f621350dba30b254c1afe732b7342c22c5f1a3219431d063599abcdb626a7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        5ffede4b0d09a4e2f5b63d4c1363e8b8

                                                                                                                                                        SHA1

                                                                                                                                                        ce45f3558b08fe54661cff5d6c2dd91e301c5124

                                                                                                                                                        SHA256

                                                                                                                                                        bc02304cb2cc42ac437af1d47ec0aa8793ea8977a92245045302d914dc975afb

                                                                                                                                                        SHA512

                                                                                                                                                        cf744bd8d91e2d6814b413898a336546086abd3d721885f35271b0210dff3805ca1f621350dba30b254c1afe732b7342c22c5f1a3219431d063599abcdb626a7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        5ffede4b0d09a4e2f5b63d4c1363e8b8

                                                                                                                                                        SHA1

                                                                                                                                                        ce45f3558b08fe54661cff5d6c2dd91e301c5124

                                                                                                                                                        SHA256

                                                                                                                                                        bc02304cb2cc42ac437af1d47ec0aa8793ea8977a92245045302d914dc975afb

                                                                                                                                                        SHA512

                                                                                                                                                        cf744bd8d91e2d6814b413898a336546086abd3d721885f35271b0210dff3805ca1f621350dba30b254c1afe732b7342c22c5f1a3219431d063599abcdb626a7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        0dfd14b2d9434f96aed2bc69f5c2439f

                                                                                                                                                        SHA1

                                                                                                                                                        9a991e42fe4515668cc24c19f08da3dd4c1b205d

                                                                                                                                                        SHA256

                                                                                                                                                        4e768723d50be3c44b2218b6723da917ac33db0952264255f21605578319efc8

                                                                                                                                                        SHA512

                                                                                                                                                        13119e06dca5ec9ace09c7b7ccee3d1c339336ffe8b70f440fc1dc04bd70b706d182369612795a9eb7273d7cf43244742ecde7906e23655461bc757a92e69f82

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        0dfd14b2d9434f96aed2bc69f5c2439f

                                                                                                                                                        SHA1

                                                                                                                                                        9a991e42fe4515668cc24c19f08da3dd4c1b205d

                                                                                                                                                        SHA256

                                                                                                                                                        4e768723d50be3c44b2218b6723da917ac33db0952264255f21605578319efc8

                                                                                                                                                        SHA512

                                                                                                                                                        13119e06dca5ec9ace09c7b7ccee3d1c339336ffe8b70f440fc1dc04bd70b706d182369612795a9eb7273d7cf43244742ecde7906e23655461bc757a92e69f82

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        0dfd14b2d9434f96aed2bc69f5c2439f

                                                                                                                                                        SHA1

                                                                                                                                                        9a991e42fe4515668cc24c19f08da3dd4c1b205d

                                                                                                                                                        SHA256

                                                                                                                                                        4e768723d50be3c44b2218b6723da917ac33db0952264255f21605578319efc8

                                                                                                                                                        SHA512

                                                                                                                                                        13119e06dca5ec9ace09c7b7ccee3d1c339336ffe8b70f440fc1dc04bd70b706d182369612795a9eb7273d7cf43244742ecde7906e23655461bc757a92e69f82

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        0dfd14b2d9434f96aed2bc69f5c2439f

                                                                                                                                                        SHA1

                                                                                                                                                        9a991e42fe4515668cc24c19f08da3dd4c1b205d

                                                                                                                                                        SHA256

                                                                                                                                                        4e768723d50be3c44b2218b6723da917ac33db0952264255f21605578319efc8

                                                                                                                                                        SHA512

                                                                                                                                                        13119e06dca5ec9ace09c7b7ccee3d1c339336ffe8b70f440fc1dc04bd70b706d182369612795a9eb7273d7cf43244742ecde7906e23655461bc757a92e69f82

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        810713dd6e1682034331e4af613b338d

                                                                                                                                                        SHA1

                                                                                                                                                        bea45dfb9dc7901fd854f4ac8758cb08b8788612

                                                                                                                                                        SHA256

                                                                                                                                                        08141e21bc53d570677f377750b23473345f1a0fad03cdbe5409687339ac2af5

                                                                                                                                                        SHA512

                                                                                                                                                        5ce9c1d12644540596234097812c3201228a19e9e66120f1fdb1d0b084de097ad2e80b8f162b48ec02d637663a8f73e0d02f5fdf35438bf0c9ad954e3ddf9429

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        810713dd6e1682034331e4af613b338d

                                                                                                                                                        SHA1

                                                                                                                                                        bea45dfb9dc7901fd854f4ac8758cb08b8788612

                                                                                                                                                        SHA256

                                                                                                                                                        08141e21bc53d570677f377750b23473345f1a0fad03cdbe5409687339ac2af5

                                                                                                                                                        SHA512

                                                                                                                                                        5ce9c1d12644540596234097812c3201228a19e9e66120f1fdb1d0b084de097ad2e80b8f162b48ec02d637663a8f73e0d02f5fdf35438bf0c9ad954e3ddf9429

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\data.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        87cfedbe498df016a016226bac7744fb

                                                                                                                                                        SHA1

                                                                                                                                                        f543b5888d56d810dad6f97eec49b3e6b904ef9f

                                                                                                                                                        SHA256

                                                                                                                                                        d2a2db3b8cfc8189408ba61e96455b2a30e51ed6b236eef832c300fef227326e

                                                                                                                                                        SHA512

                                                                                                                                                        ee8826667b4e66742e417a5caa5d243655973595950769898a5fdf50948873cca047be2a2281c7a5e0e130b9befc3e913c3444f45c3c81fa6f704d0a5e821056

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\data.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        87cfedbe498df016a016226bac7744fb

                                                                                                                                                        SHA1

                                                                                                                                                        f543b5888d56d810dad6f97eec49b3e6b904ef9f

                                                                                                                                                        SHA256

                                                                                                                                                        d2a2db3b8cfc8189408ba61e96455b2a30e51ed6b236eef832c300fef227326e

                                                                                                                                                        SHA512

                                                                                                                                                        ee8826667b4e66742e417a5caa5d243655973595950769898a5fdf50948873cca047be2a2281c7a5e0e130b9befc3e913c3444f45c3c81fa6f704d0a5e821056

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\odt\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        bd34966a06dff9296f34be85cb49e81f

                                                                                                                                                        SHA1

                                                                                                                                                        d8f8b3e999ac79eb6c736ddbdcbabe5e385a3163

                                                                                                                                                        SHA256

                                                                                                                                                        70a690487c5a144328b22afff552bbf3bf3c287baf0074bb46c4ce536e908581

                                                                                                                                                        SHA512

                                                                                                                                                        a0ce9b893caaa7671e23b82f2d5f2c31bf4c280bef30ec33033e03b72d16b8e67db89851470b053df017f0616a031a973a3c835805a9bc1ab72f3b8abb612a80

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\odt\backup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        72KB

                                                                                                                                                        MD5

                                                                                                                                                        bd34966a06dff9296f34be85cb49e81f

                                                                                                                                                        SHA1

                                                                                                                                                        d8f8b3e999ac79eb6c736ddbdcbabe5e385a3163

                                                                                                                                                        SHA256

                                                                                                                                                        70a690487c5a144328b22afff552bbf3bf3c287baf0074bb46c4ce536e908581

                                                                                                                                                        SHA512

                                                                                                                                                        a0ce9b893caaa7671e23b82f2d5f2c31bf4c280bef30ec33033e03b72d16b8e67db89851470b053df017f0616a031a973a3c835805a9bc1ab72f3b8abb612a80

                                                                                                                                                        Download Submit

                                                                                                                                                      • memory/100-387-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/224-184-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/380-327-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/396-315-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/556-164-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/752-309-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/832-219-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/972-306-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1044-372-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1116-366-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1312-259-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1444-339-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1460-312-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1516-333-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1588-284-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1616-189-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1780-174-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1792-159-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1792-381-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1844-169-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1864-209-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/1940-229-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2000-244-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2032-154-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2200-289-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2208-194-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2344-239-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2472-300-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2496-324-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2704-375-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2764-297-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2880-318-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/2940-342-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3228-303-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3264-264-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3368-369-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3372-234-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3448-351-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3456-357-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3596-199-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3676-204-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3868-294-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3892-254-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/3972-345-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4020-348-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4196-179-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4308-380-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4408-274-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4416-149-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4480-214-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4524-224-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4556-321-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4576-249-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4592-269-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4616-336-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4656-330-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4704-363-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4824-279-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4868-354-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/4884-134-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/5036-378-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/5052-144-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/5064-360-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download

                                                                                                                                                      • memory/5076-139-0x0000000000000000-mapping.dmp

                                                                                                                                                        Download