Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

08d3776669...62.exe

windows7-x64

10

08d3776669...62.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    210s
  • max time network
    211s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 14:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    08d3776669cf1303beaf820eab18eba319a5ae6bb5896586ccf375ce5138e462.exe

  • Size

    72KB

  • MD5

    0439a8654dfb5e1231a7c8283174ef07

  • SHA1

    26d51480ef96807917a9b4907aa6aed240086308

  • SHA256

    08d3776669cf1303beaf820eab18eba319a5ae6bb5896586ccf375ce5138e462

  • SHA512

    87c0fd3b1722b9559e7df8790f45c6d63b9a8b1b28bad4d99ccdabeb115ef16035f025c1f27edc1ca7958e89e9a30172336a3c6446b9098a0f883a891673b3fe

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2J:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPd

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\08d3776669cf1303beaf820eab18eba319a5ae6bb5896586ccf375ce5138e462.exe
    "C:\Users\Admin\AppData\Local\Temp\08d3776669cf1303beaf820eab18eba319a5ae6bb5896586ccf375ce5138e462.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\53100384\backup.exe
      C:\Users\Admin\AppData\Local\Temp\53100384\backup.exe C:\Users\Admin\AppData\Local\Temp\53100384\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3648
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1864
        • C:\PerfLogs\System Restore.exe
          "C:\PerfLogs\System Restore.exe" C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1128
        • C:\Program Files\System Restore.exe
          "C:\Program Files\System Restore.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1808
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2924
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:684
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:5076
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2240
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:884
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:424
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2060
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3496
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4380
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3656
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\update.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2840
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4836
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1952
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3512
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1824
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3048
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4104
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3312
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2136
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4588
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3624
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1220
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1172
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2644
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1292
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1560
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4068
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3276
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2328
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4168
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Executes dropped EXE
                    PID:2588
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • System policy modification
                    PID:3196
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4604
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4784
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4292
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3544
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1952
                • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                  8⤵
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:2536
                • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                  8⤵
                  • System policy modification
                  PID:3152
                • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                  8⤵
                  • System policy modification
                  PID:440
                • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                  8⤵
                    PID:3756
                  • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                    8⤵
                    • System policy modification
                    PID:1736
                  • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:2812
                  • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:4704
                  • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:4784
                  • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:4032
                  • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:3580
                  • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                    8⤵
                    • System policy modification
                    PID:4740
                  • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                    8⤵
                    • System policy modification
                    PID:2164
                  • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                    8⤵
                      PID:2308
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                    7⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    PID:4212
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:4984
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3120
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4340
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                      8⤵
                      • Disables RegEdit via registry modification
                      PID:2040
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:3880
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                      8⤵
                        PID:3720
                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                      7⤵
                      • Disables RegEdit via registry modification
                      • Drops file in Program Files directory
                      PID:1172
                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • System policy modification
                        PID:4560
                    • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:4768
                    • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                      7⤵
                      • Disables RegEdit via registry modification
                      PID:3004
                    • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                      7⤵
                      • Drops file in Program Files directory
                      • System policy modification
                      PID:2324
                      • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\System Restore.exe
                        "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\System Restore.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                        8⤵
                          PID:2732
                      • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:2564
                      • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Drops file in Program Files directory
                        • System policy modification
                        PID:1616
                        • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                          8⤵
                            PID:1328
                      • C:\Program Files\Common Files\Services\backup.exe
                        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2900
                      • C:\Program Files\Common Files\System\backup.exe
                        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                        6⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        PID:4316
                        • C:\Program Files\Common Files\System\ado\backup.exe
                          "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                          7⤵
                          • Modifies visibility of file extensions in Explorer
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:404
                          • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                            "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                            8⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:2240
                          • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                            "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1316
                          • C:\Program Files\Common Files\System\ado\es-ES\data.exe
                            "C:\Program Files\Common Files\System\ado\es-ES\data.exe" C:\Program Files\Common Files\System\ado\es-ES\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:5008
                          • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                            "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:4588
                          • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                            "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:2296
                          • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                            "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                            8⤵
                              PID:5108
                          • C:\Program Files\Common Files\System\de-DE\backup.exe
                            "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                            7⤵
                            • Disables RegEdit via registry modification
                            • System policy modification
                            PID:2420
                          • C:\Program Files\Common Files\System\en-US\backup.exe
                            "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:2600
                          • C:\Program Files\Common Files\System\fr-FR\backup.exe
                            "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                            7⤵
                            • System policy modification
                            PID:3056
                          • C:\Program Files\Common Files\System\es-ES\backup.exe
                            "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                            7⤵
                            • System policy modification
                            PID:1776
                          • C:\Program Files\Common Files\System\it-IT\backup.exe
                            "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                            7⤵
                              PID:2136
                            • C:\Program Files\Common Files\System\ja-JP\backup.exe
                              "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:4420
                            • C:\Program Files\Common Files\System\msadc\backup.exe
                              "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                              7⤵
                                PID:3364
                          • C:\Program Files\Google\backup.exe
                            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                            5⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:4252
                            • C:\Program Files\Google\Chrome\backup.exe
                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1864
                              • C:\Program Files\Google\Chrome\Application\data.exe
                                "C:\Program Files\Google\Chrome\Application\data.exe" C:\Program Files\Google\Chrome\Application\
                                7⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:4980
                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe
                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                  8⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1020
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                    9⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:4832
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                    9⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:4388
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                    9⤵
                                      PID:4260
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\data.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                      9⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:1700
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                      9⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System policy modification
                                      PID:2332
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                      9⤵
                                      • System policy modification
                                      PID:2792
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                      9⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:4380
                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                        10⤵
                                          PID:3388
                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                        9⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • System policy modification
                                        PID:1568
                                    • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                      8⤵
                                        PID:5112
                                • C:\Program Files\Internet Explorer\backup.exe
                                  "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                  5⤵
                                  • Disables RegEdit via registry modification
                                  • Drops file in Program Files directory
                                  • System policy modification
                                  PID:3380
                                  • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                    "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:5100
                                  • C:\Program Files\Internet Explorer\en-US\backup.exe
                                    "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                    6⤵
                                    • Disables RegEdit via registry modification
                                    PID:4232
                                  • C:\Program Files\Internet Explorer\es-ES\data.exe
                                    "C:\Program Files\Internet Explorer\es-ES\data.exe" C:\Program Files\Internet Explorer\es-ES\
                                    6⤵
                                    • System policy modification
                                    PID:2480
                                  • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:1760
                                  • C:\Program Files\Internet Explorer\images\backup.exe
                                    "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                    6⤵
                                      PID:4736
                                  • C:\Program Files\Java\backup.exe
                                    "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                    5⤵
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:2808
                                • C:\Program Files (x86)\backup.exe
                                  "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                  4⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4932
                                  • C:\Program Files (x86)\Adobe\backup.exe
                                    "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                    5⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2768
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                      6⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2300
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4180
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                        7⤵
                                        • Drops file in Program Files directory
                                        PID:4128
                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Drops file in Program Files directory
                                          PID:1464
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                            9⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            PID:2576
                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • System policy modification
                                          PID:1524
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                            9⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            PID:2188
                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                          8⤵
                                            PID:1876
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                            8⤵
                                            • Disables RegEdit via registry modification
                                            PID:4364
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Drops file in Program Files directory
                                            • System policy modification
                                            PID:4216
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              PID:3676
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Drops file in Program Files directory
                                            PID:4044
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                              9⤵
                                                PID:2472
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                            7⤵
                                            • Drops file in Program Files directory
                                            • System policy modification
                                            PID:2920
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                              8⤵
                                              • Disables RegEdit via registry modification
                                              PID:4400
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                              8⤵
                                                PID:3124
                                        • C:\Program Files (x86)\Common Files\backup.exe
                                          "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                          5⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          PID:2988
                                      • C:\Users\backup.exe
                                        C:\Users\backup.exe C:\Users\
                                        4⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • System policy modification
                                        PID:1192
                                        • C:\Users\Admin\backup.exe
                                          C:\Users\Admin\backup.exe C:\Users\Admin\
                                          5⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          PID:3836
                                          • C:\Users\Admin\Contacts\backup.exe
                                            C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                            6⤵
                                            • System policy modification
                                            PID:3276
                                          • C:\Users\Admin\3D Objects\backup.exe
                                            "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:1476
                                          • C:\Users\Admin\Desktop\backup.exe
                                            C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            PID:588
                                          • C:\Users\Admin\Documents\backup.exe
                                            C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:2816
                                          • C:\Users\Admin\Downloads\backup.exe
                                            C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                            6⤵
                                            • Disables RegEdit via registry modification
                                            PID:1848
                                          • C:\Users\Admin\Favorites\data.exe
                                            C:\Users\Admin\Favorites\data.exe C:\Users\Admin\Favorites\
                                            6⤵
                                              PID:4196
                                            • C:\Users\Admin\Links\backup.exe
                                              C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                              6⤵
                                                PID:3536
                                            • C:\Users\Public\backup.exe
                                              C:\Users\Public\backup.exe C:\Users\Public\
                                              5⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • System policy modification
                                              PID:3128
                                              • C:\Users\Public\Downloads\backup.exe
                                                C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                6⤵
                                                  PID:4060
                                                • C:\Users\Public\Music\backup.exe
                                                  C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                  6⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  PID:4388
                                                • C:\Users\Public\Pictures\backup.exe
                                                  C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                  6⤵
                                                    PID:4960
                                              • C:\Windows\backup.exe
                                                C:\Windows\backup.exe C:\Windows\
                                                4⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Drops file in Windows directory
                                                PID:1788
                                                • C:\Windows\addins\backup.exe
                                                  C:\Windows\addins\backup.exe C:\Windows\addins\
                                                  5⤵
                                                    PID:2240
                                                  • C:\Windows\appcompat\backup.exe
                                                    C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                    5⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Drops file in Windows directory
                                                    PID:4668
                                                    • C:\Windows\appcompat\encapsulation\backup.exe
                                                      C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                      6⤵
                                                        PID:4636
                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4332
                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                2⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3596
                                              • C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Low\
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1192
                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2788
                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                2⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1004
                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                2⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3344
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                              1⤵
                                              • Drops file in Program Files directory
                                              PID:4408
                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                2⤵
                                                • Disables RegEdit via registry modification
                                                PID:2040
                                            • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                              "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                              1⤵
                                              • Drops file in Program Files directory
                                              PID:2912
                                              • C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe
                                                "C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                2⤵
                                                • Disables RegEdit via registry modification
                                                • Drops file in Program Files directory
                                                PID:2432
                                              • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                2⤵
                                                  PID:3384
                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                    3⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    PID:900
                                              • C:\Users\Public\Documents\backup.exe
                                                C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                1⤵
                                                • System policy modification
                                                PID:1896
                                              • C:\Program Files\Java\jdk1.8.0_66\data.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\data.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                1⤵
                                                • Drops file in Program Files directory
                                                PID:4236
                                                • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                  "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                  2⤵
                                                  • System policy modification
                                                  PID:4340
                                                • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                  "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                  2⤵
                                                  • System policy modification
                                                  PID:4580
                                                  • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                    "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                    3⤵
                                                      PID:3592
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                  1⤵
                                                  • Disables RegEdit via registry modification
                                                  • System policy modification
                                                  PID:2476
                                                • C:\Windows\appcompat\appraiser\backup.exe
                                                  C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                  1⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Drops file in Windows directory
                                                  PID:1900
                                                  • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                    C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                    2⤵
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:1844

                                                Network

                                                MITRE ATT&CK Enterprise v6

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\PerfLogs\System Restore.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  c43a82a93ca7f0ba75e243adc4e8840e

                                                  SHA1

                                                  f0fa70d326246df434cc6afda33d81a26db1da46

                                                  SHA256

                                                  9bdb6b9f1872136b80e97a8faefd4bbd2fecec60cc6065f9fa659f00aa7afa49

                                                  SHA512

                                                  b86ceaac68f3d5e1e50ca3f9b6fc7cb5a37c8b6b790f032fe93363dce707dc661637f5ca4f5efee21833e84d7e3b9ef56494aabf2d7bf72baa3d47f348243312

                                                  Download Submit

                                                • C:\PerfLogs\System Restore.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  c43a82a93ca7f0ba75e243adc4e8840e

                                                  SHA1

                                                  f0fa70d326246df434cc6afda33d81a26db1da46

                                                  SHA256

                                                  9bdb6b9f1872136b80e97a8faefd4bbd2fecec60cc6065f9fa659f00aa7afa49

                                                  SHA512

                                                  b86ceaac68f3d5e1e50ca3f9b6fc7cb5a37c8b6b790f032fe93363dce707dc661637f5ca4f5efee21833e84d7e3b9ef56494aabf2d7bf72baa3d47f348243312

                                                  Download Submit

                                                • C:\Program Files\7-Zip\Lang\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  8f1f4a587220bd09629f46b0046b5359

                                                  SHA1

                                                  0cfa6c3cbbe904f6b316bd4a8f6c8edd4f229447

                                                  SHA256

                                                  49d87e817a1359939cc098b2dfff6a549a604f4b9694d67481eac44f4011adca

                                                  SHA512

                                                  a652fac90f96ec3fc327e40b1d1a09c0cdfc03333d62c323f18a22751ea98b05bfc95e3b9cbc9ec5609f52011f5fca41fbd9d5ff84c50fa0da4c69f11e701462

                                                  Download Submit

                                                • C:\Program Files\7-Zip\Lang\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  8f1f4a587220bd09629f46b0046b5359

                                                  SHA1

                                                  0cfa6c3cbbe904f6b316bd4a8f6c8edd4f229447

                                                  SHA256

                                                  49d87e817a1359939cc098b2dfff6a549a604f4b9694d67481eac44f4011adca

                                                  SHA512

                                                  a652fac90f96ec3fc327e40b1d1a09c0cdfc03333d62c323f18a22751ea98b05bfc95e3b9cbc9ec5609f52011f5fca41fbd9d5ff84c50fa0da4c69f11e701462

                                                  Download Submit

                                                • C:\Program Files\7-Zip\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  61d83f34d7cdb756b7ecad1874c5ceca

                                                  SHA1

                                                  e4281d1104c226167f06d0f71a30b2eb4b2090c8

                                                  SHA256

                                                  1c32d3994bc620c06cc560497915c8e37a790fc2b56d7cc3ce19609a0c477285

                                                  SHA512

                                                  3a0c3190f86f8fc66b61a5be63c5e6219879f0c1cc073d0a62d0e3544dd0ae6e6b54a7ee6278827eea42522d33296490e2d207d9a5d76ea1d15f8ae2d036cfc7

                                                  Download Submit

                                                • C:\Program Files\7-Zip\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  61d83f34d7cdb756b7ecad1874c5ceca

                                                  SHA1

                                                  e4281d1104c226167f06d0f71a30b2eb4b2090c8

                                                  SHA256

                                                  1c32d3994bc620c06cc560497915c8e37a790fc2b56d7cc3ce19609a0c477285

                                                  SHA512

                                                  3a0c3190f86f8fc66b61a5be63c5e6219879f0c1cc073d0a62d0e3544dd0ae6e6b54a7ee6278827eea42522d33296490e2d207d9a5d76ea1d15f8ae2d036cfc7

                                                  Download Submit

                                                • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  2d4f1a7f6b2e8463af0d729561135752

                                                  SHA1

                                                  51e48a99e878e818cd4cdca236ecea4b13c83a7f

                                                  SHA256

                                                  551b701e953ada27736c57274857da121c3487d7836f3e00d7e480c815483f37

                                                  SHA512

                                                  35d6ec69d2c2232cf0807bf6ff63aa6f2a54f4d9b77fc1ae9b5e455ede9f7b7f08e15b65c7160d0a2dbb854be27afece4704173297a6364b2f437341b8c34d9d

                                                  Download Submit

                                                • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  2d4f1a7f6b2e8463af0d729561135752

                                                  SHA1

                                                  51e48a99e878e818cd4cdca236ecea4b13c83a7f

                                                  SHA256

                                                  551b701e953ada27736c57274857da121c3487d7836f3e00d7e480c815483f37

                                                  SHA512

                                                  35d6ec69d2c2232cf0807bf6ff63aa6f2a54f4d9b77fc1ae9b5e455ede9f7b7f08e15b65c7160d0a2dbb854be27afece4704173297a6364b2f437341b8c34d9d

                                                  Download Submit

                                                • C:\Program Files\Common Files\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  011431a74c46b96faf0418158f0b7049

                                                  SHA1

                                                  38cc762501febbfecf176886d30e545fe429c5c0

                                                  SHA256

                                                  091fc71da90cf96f385bc66cafa41e474b495ece04cf77d29268950bac2a81f6

                                                  SHA512

                                                  703afdcc68ef4863c7c1ef77ac2ed0b4ff820599cc04fbc600333dcff94067e8c90172daa9e8a9f4486854fdfa5e6dddd2b0a82b84b5fe54e08133d9ec97c4fa

                                                  Download Submit

                                                • C:\Program Files\Common Files\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  011431a74c46b96faf0418158f0b7049

                                                  SHA1

                                                  38cc762501febbfecf176886d30e545fe429c5c0

                                                  SHA256

                                                  091fc71da90cf96f385bc66cafa41e474b495ece04cf77d29268950bac2a81f6

                                                  SHA512

                                                  703afdcc68ef4863c7c1ef77ac2ed0b4ff820599cc04fbc600333dcff94067e8c90172daa9e8a9f4486854fdfa5e6dddd2b0a82b84b5fe54e08133d9ec97c4fa

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  9c7a234e4f447c8b1651c8674180ad40

                                                  SHA1

                                                  7b502096a280b01eaef89b6c1448e1ef94c0d5d7

                                                  SHA256

                                                  0b37bc18c2eece8be1f9fb89cf9fbeb2c9c8f1d71731b398b845f1144160c65e

                                                  SHA512

                                                  7c3a5a3b4f4f4cb091feb04e37bc6fc9e51eb992f2ea1035e88217f161e4b3ddd9585d7f90a574906a766516107bfa2ff74d7017268d8a416ca4138b4d7c024d

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  9c7a234e4f447c8b1651c8674180ad40

                                                  SHA1

                                                  7b502096a280b01eaef89b6c1448e1ef94c0d5d7

                                                  SHA256

                                                  0b37bc18c2eece8be1f9fb89cf9fbeb2c9c8f1d71731b398b845f1144160c65e

                                                  SHA512

                                                  7c3a5a3b4f4f4cb091feb04e37bc6fc9e51eb992f2ea1035e88217f161e4b3ddd9585d7f90a574906a766516107bfa2ff74d7017268d8a416ca4138b4d7c024d

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  2a88c52b48de435362e505c085a6e167

                                                  SHA1

                                                  939b3e1d778199f0349b0bae1604f0676a2fb0cc

                                                  SHA256

                                                  e244eee4467d745dcb6d4ebe23704075ce387b24e48e3dd5a12b7fbc1f47bb09

                                                  SHA512

                                                  aee0c4c018e7c809cf0a3571041c711525a47ba90ee0fc8b53bb1406ed83b74927930749af8e0d5362dd1123e17816c6605d91286b0841339678a5a1b88fd9f8

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  2a88c52b48de435362e505c085a6e167

                                                  SHA1

                                                  939b3e1d778199f0349b0bae1604f0676a2fb0cc

                                                  SHA256

                                                  e244eee4467d745dcb6d4ebe23704075ce387b24e48e3dd5a12b7fbc1f47bb09

                                                  SHA512

                                                  aee0c4c018e7c809cf0a3571041c711525a47ba90ee0fc8b53bb1406ed83b74927930749af8e0d5362dd1123e17816c6605d91286b0841339678a5a1b88fd9f8

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  9c7a234e4f447c8b1651c8674180ad40

                                                  SHA1

                                                  7b502096a280b01eaef89b6c1448e1ef94c0d5d7

                                                  SHA256

                                                  0b37bc18c2eece8be1f9fb89cf9fbeb2c9c8f1d71731b398b845f1144160c65e

                                                  SHA512

                                                  7c3a5a3b4f4f4cb091feb04e37bc6fc9e51eb992f2ea1035e88217f161e4b3ddd9585d7f90a574906a766516107bfa2ff74d7017268d8a416ca4138b4d7c024d

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  9c7a234e4f447c8b1651c8674180ad40

                                                  SHA1

                                                  7b502096a280b01eaef89b6c1448e1ef94c0d5d7

                                                  SHA256

                                                  0b37bc18c2eece8be1f9fb89cf9fbeb2c9c8f1d71731b398b845f1144160c65e

                                                  SHA512

                                                  7c3a5a3b4f4f4cb091feb04e37bc6fc9e51eb992f2ea1035e88217f161e4b3ddd9585d7f90a574906a766516107bfa2ff74d7017268d8a416ca4138b4d7c024d

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\update.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\update.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  82312b7d3b29cbf2998ae9b9d79ff3ea

                                                  SHA1

                                                  b8e5c53f758039be80a900ba7517860f0306027f

                                                  SHA256

                                                  631a6f9992a86435993e005b03391755df5ac90cd8c81c49c3c7a7e91f0b8538

                                                  SHA512

                                                  12eff5bc83c0389c62c6f6eaa65a53f1bce81d7d45c84cb48f7abaf7d366ce8b26c0e01ef8910eb030f74a4e3cba4678667bf52f5cd0e216c1248d67e26e5a48

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  d32d645d322ea6ba4325da3795644d80

                                                  SHA1

                                                  b292c5e9fd5187a93733a2e9682fe4e799c3fcf7

                                                  SHA256

                                                  464a066564737977e93002fd7a91c6cdea6c769b7f6bc3117925920bb5c10f53

                                                  SHA512

                                                  c359fde0988acd72f28039d8d211358eb79032305ced986860acfa1536b7f044183815d6fbc6d588654f0f96838c1658a176d9915638ddd2a0356e4bfbf38b6f

                                                  Download Submit

                                                • C:\Program Files\System Restore.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  c43a82a93ca7f0ba75e243adc4e8840e

                                                  SHA1

                                                  f0fa70d326246df434cc6afda33d81a26db1da46

                                                  SHA256

                                                  9bdb6b9f1872136b80e97a8faefd4bbd2fecec60cc6065f9fa659f00aa7afa49

                                                  SHA512

                                                  b86ceaac68f3d5e1e50ca3f9b6fc7cb5a37c8b6b790f032fe93363dce707dc661637f5ca4f5efee21833e84d7e3b9ef56494aabf2d7bf72baa3d47f348243312

                                                  Download Submit

                                                • C:\Program Files\System Restore.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  c43a82a93ca7f0ba75e243adc4e8840e

                                                  SHA1

                                                  f0fa70d326246df434cc6afda33d81a26db1da46

                                                  SHA256

                                                  9bdb6b9f1872136b80e97a8faefd4bbd2fecec60cc6065f9fa659f00aa7afa49

                                                  SHA512

                                                  b86ceaac68f3d5e1e50ca3f9b6fc7cb5a37c8b6b790f032fe93363dce707dc661637f5ca4f5efee21833e84d7e3b9ef56494aabf2d7bf72baa3d47f348243312

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\53100384\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  faa65c7dda241ad1cfbb0aaef3d52970

                                                  SHA1

                                                  01fe37220823545c8bb58e63936a3de62a8b0b6c

                                                  SHA256

                                                  6ae202d106a46acccf2ac6617f1cc5cc5cefeb365d783e0520c996c593d27bf6

                                                  SHA512

                                                  7323de6abf3aa4b0ee0e5854564311ff439817c4867eaba011b75d76555ecac8d3a68bd6028b4d76d1f85cad067ab0b46739d8f5b6c139e3c3e6a4ee681bca1e

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\53100384\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  faa65c7dda241ad1cfbb0aaef3d52970

                                                  SHA1

                                                  01fe37220823545c8bb58e63936a3de62a8b0b6c

                                                  SHA256

                                                  6ae202d106a46acccf2ac6617f1cc5cc5cefeb365d783e0520c996c593d27bf6

                                                  SHA512

                                                  7323de6abf3aa4b0ee0e5854564311ff439817c4867eaba011b75d76555ecac8d3a68bd6028b4d76d1f85cad067ab0b46739d8f5b6c139e3c3e6a4ee681bca1e

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  eb29043547ddc894b4383ebcde418ee1

                                                  SHA1

                                                  c46fe2c5f1ccdb215b8c2be078246144314cdfc4

                                                  SHA256

                                                  21d6578ba451c4efbed07fb5432736cfb4253e4a30fb66d81c229422c18d4c7b

                                                  SHA512

                                                  7da13bfa4181fb107534a5edc0b82cf6ff642b69d68818bb40e958b0d7c6453a006b0f834cc261489be628a95184dcc140a17c50193ade0524d80ea2b8db5b16

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  eb29043547ddc894b4383ebcde418ee1

                                                  SHA1

                                                  c46fe2c5f1ccdb215b8c2be078246144314cdfc4

                                                  SHA256

                                                  21d6578ba451c4efbed07fb5432736cfb4253e4a30fb66d81c229422c18d4c7b

                                                  SHA512

                                                  7da13bfa4181fb107534a5edc0b82cf6ff642b69d68818bb40e958b0d7c6453a006b0f834cc261489be628a95184dcc140a17c50193ade0524d80ea2b8db5b16

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  eb29043547ddc894b4383ebcde418ee1

                                                  SHA1

                                                  c46fe2c5f1ccdb215b8c2be078246144314cdfc4

                                                  SHA256

                                                  21d6578ba451c4efbed07fb5432736cfb4253e4a30fb66d81c229422c18d4c7b

                                                  SHA512

                                                  7da13bfa4181fb107534a5edc0b82cf6ff642b69d68818bb40e958b0d7c6453a006b0f834cc261489be628a95184dcc140a17c50193ade0524d80ea2b8db5b16

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  eb29043547ddc894b4383ebcde418ee1

                                                  SHA1

                                                  c46fe2c5f1ccdb215b8c2be078246144314cdfc4

                                                  SHA256

                                                  21d6578ba451c4efbed07fb5432736cfb4253e4a30fb66d81c229422c18d4c7b

                                                  SHA512

                                                  7da13bfa4181fb107534a5edc0b82cf6ff642b69d68818bb40e958b0d7c6453a006b0f834cc261489be628a95184dcc140a17c50193ade0524d80ea2b8db5b16

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e8d65a7b44692eebf8dfca3eca262cb3

                                                  SHA1

                                                  6de18ff864819d360b7286746b28f7060f13f01e

                                                  SHA256

                                                  f460a69d3d279a01318943ff30c58af50c4e5824d5eb8e562a45075c4cf35278

                                                  SHA512

                                                  f4e3b1938c4fc94c48b8cf37df82009ced5b151609a80e050bcbebee2c03651822dd0dd53a147f7de600d531fa4645f71ee949e9f7d9d16e3b3c4a9ee58d97bd

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e8d65a7b44692eebf8dfca3eca262cb3

                                                  SHA1

                                                  6de18ff864819d360b7286746b28f7060f13f01e

                                                  SHA256

                                                  f460a69d3d279a01318943ff30c58af50c4e5824d5eb8e562a45075c4cf35278

                                                  SHA512

                                                  f4e3b1938c4fc94c48b8cf37df82009ced5b151609a80e050bcbebee2c03651822dd0dd53a147f7de600d531fa4645f71ee949e9f7d9d16e3b3c4a9ee58d97bd

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  3e06903528459b037a2dddb91ec0eda0

                                                  SHA1

                                                  0414300e400ad70c58ad5e0f6210cf1b3608dd33

                                                  SHA256

                                                  6fa943acbea6f244280f77bd7a22e873ae5c3a8dc8be3f12923dcf4b3eeb3edc

                                                  SHA512

                                                  baf36f887087a76c3ac5eb8f5d804cf499c1f6860eac5ab86a90a81d8e13a1b5319140ac8d95ae0afbbf3466cc62dea4929915d2b3bf458aeb3c1841c724c608

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  3e06903528459b037a2dddb91ec0eda0

                                                  SHA1

                                                  0414300e400ad70c58ad5e0f6210cf1b3608dd33

                                                  SHA256

                                                  6fa943acbea6f244280f77bd7a22e873ae5c3a8dc8be3f12923dcf4b3eeb3edc

                                                  SHA512

                                                  baf36f887087a76c3ac5eb8f5d804cf499c1f6860eac5ab86a90a81d8e13a1b5319140ac8d95ae0afbbf3466cc62dea4929915d2b3bf458aeb3c1841c724c608

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  fb7e78755927870a022270ceb9b4e3e0

                                                  SHA1

                                                  f507f36478a89353558985a76bf9c8d0c02e8a78

                                                  SHA256

                                                  54ff077505f36b9c550e8b4404f00313d0fa8037fd940dc72ca48f4df58fd824

                                                  SHA512

                                                  0ab45603793b75d4c06f7e42103b56e240a750adba404aac93a58c50e907a10c47fb2d8a31b43a170c0f26355d474a9a5597c3e78ca1acf78f6a28b8f1c845c9

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  fb7e78755927870a022270ceb9b4e3e0

                                                  SHA1

                                                  f507f36478a89353558985a76bf9c8d0c02e8a78

                                                  SHA256

                                                  54ff077505f36b9c550e8b4404f00313d0fa8037fd940dc72ca48f4df58fd824

                                                  SHA512

                                                  0ab45603793b75d4c06f7e42103b56e240a750adba404aac93a58c50e907a10c47fb2d8a31b43a170c0f26355d474a9a5597c3e78ca1acf78f6a28b8f1c845c9

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e8d65a7b44692eebf8dfca3eca262cb3

                                                  SHA1

                                                  6de18ff864819d360b7286746b28f7060f13f01e

                                                  SHA256

                                                  f460a69d3d279a01318943ff30c58af50c4e5824d5eb8e562a45075c4cf35278

                                                  SHA512

                                                  f4e3b1938c4fc94c48b8cf37df82009ced5b151609a80e050bcbebee2c03651822dd0dd53a147f7de600d531fa4645f71ee949e9f7d9d16e3b3c4a9ee58d97bd

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e8d65a7b44692eebf8dfca3eca262cb3

                                                  SHA1

                                                  6de18ff864819d360b7286746b28f7060f13f01e

                                                  SHA256

                                                  f460a69d3d279a01318943ff30c58af50c4e5824d5eb8e562a45075c4cf35278

                                                  SHA512

                                                  f4e3b1938c4fc94c48b8cf37df82009ced5b151609a80e050bcbebee2c03651822dd0dd53a147f7de600d531fa4645f71ee949e9f7d9d16e3b3c4a9ee58d97bd

                                                  Download Submit

                                                • C:\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  59f7cf9b79a2744e05e2777a6f779865

                                                  SHA1

                                                  7e5693f0a9fb04d58dc62e2168431f8b9360a1ce

                                                  SHA256

                                                  12e785de30bcd71de2ce0a7c725801a2442a0a37e7147f2b694545fb5fc78446

                                                  SHA512

                                                  b9f7dbec0e59a3919bea3c2f801d801ec064a8637be2ec7656a69aa848bfe2f9ebaa1281e4d7da5f775f920e803b73818190e91e0b2094d1ce09978965198360

                                                  Download Submit

                                                • C:\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  59f7cf9b79a2744e05e2777a6f779865

                                                  SHA1

                                                  7e5693f0a9fb04d58dc62e2168431f8b9360a1ce

                                                  SHA256

                                                  12e785de30bcd71de2ce0a7c725801a2442a0a37e7147f2b694545fb5fc78446

                                                  SHA512

                                                  b9f7dbec0e59a3919bea3c2f801d801ec064a8637be2ec7656a69aa848bfe2f9ebaa1281e4d7da5f775f920e803b73818190e91e0b2094d1ce09978965198360

                                                  Download Submit

                                                • C:\odt\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  c464c68c1a8b467ba316bca4ec5c896c

                                                  SHA1

                                                  dff4e07afbd8c951b37ec83a98127453841998c6

                                                  SHA256

                                                  a9ad6caccbbbf01f038f7bc612ef79dce346c3391ee3d86a980845423df02e50

                                                  SHA512

                                                  8947b54ea30684f45a57abdb5c9bad61d7882e3a371f5c6200ac05cb419f75e8f9e8ce0f507c8b36507e9bb176e6e5d1e02c5b47598e681a572cd41c553cda78

                                                  Download Submit

                                                • C:\odt\backup.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  c464c68c1a8b467ba316bca4ec5c896c

                                                  SHA1

                                                  dff4e07afbd8c951b37ec83a98127453841998c6

                                                  SHA256

                                                  a9ad6caccbbbf01f038f7bc612ef79dce346c3391ee3d86a980845423df02e50

                                                  SHA512

                                                  8947b54ea30684f45a57abdb5c9bad61d7882e3a371f5c6200ac05cb419f75e8f9e8ce0f507c8b36507e9bb176e6e5d1e02c5b47598e681a572cd41c553cda78

                                                  Download Submit