Overview

overview

10

Static

static

6ddd97f265...66.exe

windows7-x64

10

6ddd97f265...66.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    192s
  • max time network
    235s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 20:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6ddd97f2655bdf18f4f287983d0e5aab08d91799d8f76efdeff79d1a3f8b7c66.exe

  • Size

    72KB

  • MD5

    e1bb90ff047fc191a2219e08cb338b8b

  • SHA1

    1a767c4f1cd49a1f786cfa52923de02da978afc0

  • SHA256

    6ddd97f2655bdf18f4f287983d0e5aab08d91799d8f76efdeff79d1a3f8b7c66

  • SHA512

    23268fb62112942f3b20a0c075f7bcb8aedad816d2d2cb8a1a639969a57caaea82db01b7b29825b8ffed715bfeb76d6790a793886406bed304605d8077efbfa7

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2p:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrl

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ddd97f2655bdf18f4f287983d0e5aab08d91799d8f76efdeff79d1a3f8b7c66.exe
    "C:\Users\Admin\AppData\Local\Temp\6ddd97f2655bdf18f4f287983d0e5aab08d91799d8f76efdeff79d1a3f8b7c66.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Users\Admin\AppData\Local\Temp\3156363225\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3156363225\backup.exe C:\Users\Admin\AppData\Local\Temp\3156363225\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4424
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1344
        • C:\PerfLogs\data.exe
          C:\PerfLogs\data.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3480
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1908
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1012
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3780
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4284
            • C:\Program Files\Common Files\DESIGNER\System Restore.exe
              "C:\Program Files\Common Files\DESIGNER\System Restore.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4224
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:676
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1688
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4988
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1264
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4888
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1504
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2328
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4868
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:444
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4656
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4884
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1128
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  PID:4516
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3916
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • System policy modification
                  PID:1080
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:3152
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:4972
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:536
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                      PID:2000
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                      9⤵
                        PID:3628
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                        9⤵
                          PID:208
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                          9⤵
                            PID:4640
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                            9⤵
                              PID:4332
                          • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                            8⤵
                              PID:1200
                            • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                              8⤵
                                PID:2348
                              • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                                8⤵
                                  PID:3576
                                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\System Restore.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                                  8⤵
                                    PID:3156
                                • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1884
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4396
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                    8⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:4080
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\update.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3656
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                    8⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5068
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                    8⤵
                                    • System policy modification
                                    PID:4576
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                    8⤵
                                    • System policy modification
                                    PID:2608
                                • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                  7⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:3404
                                  • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:2000
                                • C:\Program Files\Common Files\microsoft shared\Source Engine\update.exe
                                  "C:\Program Files\Common Files\microsoft shared\Source Engine\update.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:4556
                                • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                  7⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1412
                                • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3516
                                • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:2852
                                  • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:4840
                                • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Drops file in Program Files directory
                                  • System policy modification
                                  PID:2796
                                  • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                    8⤵
                                      PID:2444
                                  • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:1564
                                  • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    PID:2508
                                  • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                    7⤵
                                      PID:3356
                                      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                        8⤵
                                          PID:940
                                          • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\System Restore.exe
                                            "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\System Restore.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                            9⤵
                                              PID:3784
                                      • C:\Program Files\Common Files\Services\System Restore.exe
                                        "C:\Program Files\Common Files\Services\System Restore.exe" C:\Program Files\Common Files\Services\
                                        6⤵
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4612
                                      • C:\Program Files\Common Files\System\backup.exe
                                        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                        6⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:4560
                                        • C:\Program Files\Common Files\System\ado\backup.exe
                                          "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                          7⤵
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:5084
                                          • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                            "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4572
                                          • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                            "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                            8⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:4616
                                          • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                            "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2288
                                          • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                            "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                            8⤵
                                            • System policy modification
                                            PID:4864
                                          • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                            "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                            8⤵
                                              PID:3564
                                            • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                              "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:864
                                          • C:\Program Files\Common Files\System\de-DE\backup.exe
                                            "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:4660
                                          • C:\Program Files\Common Files\System\en-US\backup.exe
                                            "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:4116
                                          • C:\Program Files\Common Files\System\es-ES\backup.exe
                                            "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                            7⤵
                                            • System policy modification
                                            PID:4460
                                          • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                            "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:3136
                                          • C:\Program Files\Common Files\System\it-IT\backup.exe
                                            "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                            7⤵
                                              PID:2976
                                            • C:\Program Files\Common Files\System\msadc\backup.exe
                                              "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                              7⤵
                                                PID:4972
                                                • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                  8⤵
                                                    PID:2148
                                                • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                  "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                  7⤵
                                                    PID:1344
                                              • C:\Program Files\Google\backup.exe
                                                "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                5⤵
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5104
                                                • C:\Program Files\Google\Chrome\backup.exe
                                                  "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4276
                                                  • C:\Program Files\Google\Chrome\Application\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                    7⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2284
                                                    • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                      8⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:2160
                                              • C:\Program Files\Internet Explorer\backup.exe
                                                "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                5⤵
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2496
                                                • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                  "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4628
                                                • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                  "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2204
                                                • C:\Program Files\Internet Explorer\es-ES\update.exe
                                                  "C:\Program Files\Internet Explorer\es-ES\update.exe" C:\Program Files\Internet Explorer\es-ES\
                                                  6⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3120
                                                • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:1500
                                                • C:\Program Files\Internet Explorer\images\backup.exe
                                                  "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                  6⤵
                                                    PID:3792
                                                  • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                    "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                    6⤵
                                                      PID:3212
                                                    • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                      "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:4412
                                                    • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                      "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      PID:1488
                                                  • C:\Program Files\Java\backup.exe
                                                    "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                    5⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Drops file in Program Files directory
                                                    PID:4676
                                                    • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                      "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      • Drops file in Program Files directory
                                                      PID:2672
                                                      • C:\Program Files\Java\jdk1.8.0_66\bin\update.exe
                                                        "C:\Program Files\Java\jdk1.8.0_66\bin\update.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                        7⤵
                                                        • System policy modification
                                                        PID:4048
                                                      • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                        "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                        7⤵
                                                        • Drops file in Program Files directory
                                                        PID:3832
                                                        • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                          "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                          8⤵
                                                            PID:3516
                                                          • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                            "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                            8⤵
                                                              PID:764
                                                          • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                            "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                            7⤵
                                                              PID:4344
                                                              • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                8⤵
                                                                  PID:4072
                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                7⤵
                                                                  PID:1208
                                                              • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                6⤵
                                                                  PID:1780
                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                    7⤵
                                                                      PID:3476
                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                        8⤵
                                                                          PID:2380
                                                                        • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                          "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                          8⤵
                                                                            PID:3644
                                                                    • C:\Program Files\Microsoft Office\backup.exe
                                                                      "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                      5⤵
                                                                      • Disables RegEdit via registry modification
                                                                      • Drops file in Program Files directory
                                                                      PID:1356
                                                                      • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                        "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                        6⤵
                                                                        • System policy modification
                                                                        PID:2100
                                                                      • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                        "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                        6⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • System policy modification
                                                                        PID:5040
                                                                      • C:\Program Files\Microsoft Office\root\backup.exe
                                                                        "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                        6⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        PID:444
                                                                        • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                          "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                          7⤵
                                                                            PID:4500
                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\update.exe
                                                                            "C:\Program Files\Microsoft Office\root\Document Themes 16\update.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                            7⤵
                                                                              PID:5064
                                                                              • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                                "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                                8⤵
                                                                                  PID:944
                                                                            • C:\Program Files\Microsoft Office\Updates\backup.exe
                                                                              "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
                                                                              6⤵
                                                                                PID:2604
                                                                                • C:\Program Files\Microsoft Office\Updates\Apply\backup.exe
                                                                                  "C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\
                                                                                  7⤵
                                                                                    PID:1560
                                                                                    • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe
                                                                                      "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\
                                                                                      8⤵
                                                                                        PID:1788
                                                                                        • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\4705ECFD-ABBD-4089-8453-56EA3EB6E985\backup.exe
                                                                                          "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\4705ECFD-ABBD-4089-8453-56EA3EB6E985\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\4705ECFD-ABBD-4089-8453-56EA3EB6E985\
                                                                                          9⤵
                                                                                            PID:4592
                                                                                      • C:\Program Files\Microsoft Office\Updates\Download\backup.exe
                                                                                        "C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\
                                                                                        7⤵
                                                                                          PID:4128
                                                                                    • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                      "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                      5⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:620
                                                                                      • C:\Program Files\Microsoft Office 15\ClientX64\update.exe
                                                                                        "C:\Program Files\Microsoft Office 15\ClientX64\update.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                        6⤵
                                                                                          PID:3664
                                                                                      • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                        "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                        5⤵
                                                                                          PID:3004
                                                                                          • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                                                            "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                                                            6⤵
                                                                                              PID:3596
                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\backup.exe
                                                                                                "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
                                                                                                7⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                • System policy modification
                                                                                                PID:3620
                                                                                              • C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
                                                                                                "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
                                                                                                7⤵
                                                                                                  PID:4500
                                                                                          • C:\Program Files (x86)\backup.exe
                                                                                            "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3384
                                                                                            • C:\Program Files (x86)\Adobe\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in Program Files directory
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:2072
                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\data.exe
                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                6⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:2848
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                  7⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:3060
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                    8⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Drops file in Program Files directory
                                                                                                    • System policy modification
                                                                                                    PID:2696
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                      9⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:4420
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                    8⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Drops file in Program Files directory
                                                                                                    PID:5020
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                      9⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:3620
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                    8⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • System policy modification
                                                                                                    PID:3560
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                    8⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • System policy modification
                                                                                                    PID:4632
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\System Restore.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                    8⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Drops file in Program Files directory
                                                                                                    PID:1108
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                      9⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • System policy modification
                                                                                                      PID:2592
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                    8⤵
                                                                                                      PID:1700
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                        9⤵
                                                                                                          PID:4812
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                        8⤵
                                                                                                          PID:4388
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                          8⤵
                                                                                                            PID:2692
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                              9⤵
                                                                                                                PID:3916
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                            7⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:1076
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                            7⤵
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:4316
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                              8⤵
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:3596
                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                9⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                PID:1860
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                              8⤵
                                                                                                                PID:3620
                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                8⤵
                                                                                                                  PID:1412
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                    9⤵
                                                                                                                      PID:3776
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                        10⤵
                                                                                                                          PID:3912
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                          10⤵
                                                                                                                            PID:2628
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                      7⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      PID:1708
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\data.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                        8⤵
                                                                                                                          PID:4064
                                                                                                                  • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                    5⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:2532
                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                      6⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • System policy modification
                                                                                                                      PID:4472
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                        7⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        PID:3624
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                        7⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        • System policy modification
                                                                                                                        PID:2692
                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                          8⤵
                                                                                                                            PID:3888
                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                          7⤵
                                                                                                                            PID:2848
                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                              8⤵
                                                                                                                                PID:4456
                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                              7⤵
                                                                                                                                PID:1680
                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                  8⤵
                                                                                                                                    PID:4964
                                                                                                                              • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                6⤵
                                                                                                                                  PID:4544
                                                                                                                                  • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                    7⤵
                                                                                                                                      PID:2528
                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                    6⤵
                                                                                                                                      PID:4820
                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                        7⤵
                                                                                                                                          PID:3728
                                                                                                                                    • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                      5⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      PID:1264
                                                                                                                                      • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                        6⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        PID:5044
                                                                                                                                      • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                        6⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        PID:1496
                                                                                                                                      • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                        6⤵
                                                                                                                                          PID:384
                                                                                                                                        • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                          6⤵
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:5052
                                                                                                                                          • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                            7⤵
                                                                                                                                              PID:972
                                                                                                                                            • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                              7⤵
                                                                                                                                                PID:4424
                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                            5⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            • System policy modification
                                                                                                                                            PID:4856
                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                              6⤵
                                                                                                                                                PID:3600
                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                6⤵
                                                                                                                                                  PID:4068
                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                  6⤵
                                                                                                                                                    PID:2780
                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                    6⤵
                                                                                                                                                      PID:4032
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\data.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\data.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                                                    5⤵
                                                                                                                                                      PID:3672
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\
                                                                                                                                                        6⤵
                                                                                                                                                          PID:2260
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
                                                                                                                                                            7⤵
                                                                                                                                                              PID:1980
                                                                                                                                                      • C:\Users\backup.exe
                                                                                                                                                        C:\Users\backup.exe C:\Users\
                                                                                                                                                        4⤵
                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:1828
                                                                                                                                                        • C:\Users\Admin\update.exe
                                                                                                                                                          C:\Users\Admin\update.exe C:\Users\Admin\
                                                                                                                                                          5⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:4028
                                                                                                                                                          • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                            C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                            6⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:1484
                                                                                                                                                          • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                            "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                            6⤵
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            • System policy modification
                                                                                                                                                            PID:864
                                                                                                                                                          • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                            C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                            6⤵
                                                                                                                                                              PID:2784
                                                                                                                                                            • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                              C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                              6⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:4828
                                                                                                                                                            • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                              C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                              6⤵
                                                                                                                                                                PID:804
                                                                                                                                                              • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:4964
                                                                                                                                                                • C:\Users\Admin\Links\update.exe
                                                                                                                                                                  C:\Users\Admin\Links\update.exe C:\Users\Admin\Links\
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:4212
                                                                                                                                                                  • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:2348
                                                                                                                                                                  • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                    C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:1332
                                                                                                                                                                    • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                      C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:5108
                                                                                                                                                                        • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                          "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:2320
                                                                                                                                                                          • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                            "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:2312
                                                                                                                                                                          • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                            "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:3036
                                                                                                                                                                          • C:\Users\Public\backup.exe
                                                                                                                                                                            C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                            PID:1932
                                                                                                                                                                            • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                              C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:4932
                                                                                                                                                                            • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                              C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:1680
                                                                                                                                                                            • C:\Users\Public\Music\backup.exe
                                                                                                                                                                              C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:4748
                                                                                                                                                                            • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                              C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              PID:208
                                                                                                                                                                            • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                              C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:8
                                                                                                                                                                          • C:\Windows\backup.exe
                                                                                                                                                                            C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System policy modification
                                                                                                                                                                            PID:3632
                                                                                                                                                                            • C:\Windows\addins\backup.exe
                                                                                                                                                                              C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              PID:2328
                                                                                                                                                                            • C:\Windows\appcompat\backup.exe
                                                                                                                                                                              C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:1456
                                                                                                                                                                              • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • System policy modification
                                                                                                                                                                                PID:4032
                                                                                                                                                                                • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                  C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:3720
                                                                                                                                                                                • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                  C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:1968
                                                                                                                                                                                  • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                    C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:3064
                                                                                                                                                                                  • C:\Windows\apppatch\data.exe
                                                                                                                                                                                    C:\Windows\apppatch\data.exe C:\Windows\apppatch\
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:4620
                                                                                                                                                                                      • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                                                                        C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:4880
                                                                                                                                                                                          • C:\Windows\apppatch\Custom\Custom64\update.exe
                                                                                                                                                                                            C:\Windows\apppatch\Custom\Custom64\update.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:1200
                                                                                                                                                                                          • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                                                                            C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:3656
                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:4868
                                                                                                                                                                                            • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:1932
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:4080
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:1720
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:2672
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:2760
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:2236
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:4028
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:3848
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:2112
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:1808
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:444
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:1168
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:964
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\update.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                            PID:3508
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4228
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1684
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:3680
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:3792
                                                                                                                                                                                                • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4824
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1332
                                                                                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4484

                                                                                                                                                                                                        Network

                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                        • C:\PerfLogs\data.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e3d67439eed965ed097bcf4ddfd58812

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          6e9dce955864a4cd80d36a7dec2dd602e1d31d27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          7c59c33b6f391b0c0aded0f8a8357e7e425294cfbc2725f7f13823b80b220a3a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e35e305d6f6c102dec2a2640bbeed4c4da8a23cd4b5d530fcde7dad0150f64f306cbf4bfbf50710ed60a0a21ca9e01f4233c8381ece9b25df1847e847fd22be2

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\PerfLogs\data.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e3d67439eed965ed097bcf4ddfd58812

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          6e9dce955864a4cd80d36a7dec2dd602e1d31d27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          7c59c33b6f391b0c0aded0f8a8357e7e425294cfbc2725f7f13823b80b220a3a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e35e305d6f6c102dec2a2640bbeed4c4da8a23cd4b5d530fcde7dad0150f64f306cbf4bfbf50710ed60a0a21ca9e01f4233c8381ece9b25df1847e847fd22be2

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          73142b2dcddd639516b123f2585df8ed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3cd4923cd42d442b089cdebc8ba4b057748c50e2

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c0edbb9fba800248e00979404f1bd799b6bd6f60cc865f350308f00097176f6a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          4891b246385301128622705bf36249dad7287a62141a014f5292df96c4806526102991e9df16d7f8ed97272ac121e709585ab4d05a67de551169c8273f6f16a8

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          73142b2dcddd639516b123f2585df8ed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3cd4923cd42d442b089cdebc8ba4b057748c50e2

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c0edbb9fba800248e00979404f1bd799b6bd6f60cc865f350308f00097176f6a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          4891b246385301128622705bf36249dad7287a62141a014f5292df96c4806526102991e9df16d7f8ed97272ac121e709585ab4d05a67de551169c8273f6f16a8

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files (x86)\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a4d772c431fe9832e01bed68cca1868a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          8db47a11aad462de34f09579239aa2e687ad3fab

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3e3491d8c45eb423cffbd7c4c5c58582259dee71caceb21ea1f727a73f5c049b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8f484c87acc45250cd53d1956a2b43ff14531b17b1ab301c9eeb44594bbe91d488935b5fe9ed4ca6afa021ef092e036cc6bb0bbdd207f2a20ef0012804365eca

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files (x86)\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a4d772c431fe9832e01bed68cca1868a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          8db47a11aad462de34f09579239aa2e687ad3fab

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3e3491d8c45eb423cffbd7c4c5c58582259dee71caceb21ea1f727a73f5c049b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8f484c87acc45250cd53d1956a2b43ff14531b17b1ab301c9eeb44594bbe91d488935b5fe9ed4ca6afa021ef092e036cc6bb0bbdd207f2a20ef0012804365eca

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b842f268ee87df176bf3e79b0f066c0d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          496d483cca881d4e2a900cc33b9687603e0e4e49

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          0f61d3263a4fdeb9685722d0895b966038cbc239a112160a737e9a48dcf264d8

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          455eb446b9bef1609299c7fff4272d34a1e4d3a7bc7f5d5d10519ba6e6071eeb1b6723615fab71cc9e92977956233be8fec7027b9696819ea55b9deb24a7b212

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b842f268ee87df176bf3e79b0f066c0d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          496d483cca881d4e2a900cc33b9687603e0e4e49

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          0f61d3263a4fdeb9685722d0895b966038cbc239a112160a737e9a48dcf264d8

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          455eb446b9bef1609299c7fff4272d34a1e4d3a7bc7f5d5d10519ba6e6071eeb1b6723615fab71cc9e92977956233be8fec7027b9696819ea55b9deb24a7b212

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a0a33b3cc20de3b43ffed45cc98d67c6

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          14e7a6273db768284fe7c8c70850a6ac8d78d344

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d1557c1e99a9586544fd46372d8364d4a81d13ba03901d1b9d4d421b599d402f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d9741c4d066a0b05c8ca88a199e3c1562972200fe3b47ec6069e6ad1c98350eb1594fe4ebd5d6ae384c33cade737c24b0ecad4dd78fea8ef8908936d5c227076

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a0a33b3cc20de3b43ffed45cc98d67c6

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          14e7a6273db768284fe7c8c70850a6ac8d78d344

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d1557c1e99a9586544fd46372d8364d4a81d13ba03901d1b9d4d421b599d402f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d9741c4d066a0b05c8ca88a199e3c1562972200fe3b47ec6069e6ad1c98350eb1594fe4ebd5d6ae384c33cade737c24b0ecad4dd78fea8ef8908936d5c227076

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\DESIGNER\System Restore.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          c1de468b5ad1b27137174a3091f20df0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          97c162009ec32db54a0473bb011caa5fceee8ff4

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          915be912ed564e3f6dbf51353fd773febf73980885d9c562e1e06adabdbe216c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          202fa3c72e06e89096d3d178476edb78de8d2a13bafd163bc5991da38c5e9660dfcf3000f8cf790445e07340e979b31cbc9eb3dc191c091f68882048226367c9

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\DESIGNER\System Restore.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          c1de468b5ad1b27137174a3091f20df0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          97c162009ec32db54a0473bb011caa5fceee8ff4

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          915be912ed564e3f6dbf51353fd773febf73980885d9c562e1e06adabdbe216c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          202fa3c72e06e89096d3d178476edb78de8d2a13bafd163bc5991da38c5e9660dfcf3000f8cf790445e07340e979b31cbc9eb3dc191c091f68882048226367c9

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\Services\System Restore.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          6da8f2443b1976e6b0b96b588814261d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          03baedf7367d5404447128731aaeddf64f539ec1

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          cec3a5bcad8bfc203db520e1a3040c1c231bc7fd111ce536231e6be55f47e8ad

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          820c5f6822c331493a6345467b94948e937c9c33a1ba319088378f4e5fb9a3d607274c7c2cb59ecf15063caa2ec35f2b57ac8a266a06a88edf6e47fac7338eda

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\Services\System Restore.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          6da8f2443b1976e6b0b96b588814261d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          03baedf7367d5404447128731aaeddf64f539ec1

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          cec3a5bcad8bfc203db520e1a3040c1c231bc7fd111ce536231e6be55f47e8ad

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          820c5f6822c331493a6345467b94948e937c9c33a1ba319088378f4e5fb9a3d607274c7c2cb59ecf15063caa2ec35f2b57ac8a266a06a88edf6e47fac7338eda

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a0a33b3cc20de3b43ffed45cc98d67c6

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          14e7a6273db768284fe7c8c70850a6ac8d78d344

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d1557c1e99a9586544fd46372d8364d4a81d13ba03901d1b9d4d421b599d402f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d9741c4d066a0b05c8ca88a199e3c1562972200fe3b47ec6069e6ad1c98350eb1594fe4ebd5d6ae384c33cade737c24b0ecad4dd78fea8ef8908936d5c227076

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a0a33b3cc20de3b43ffed45cc98d67c6

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          14e7a6273db768284fe7c8c70850a6ac8d78d344

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d1557c1e99a9586544fd46372d8364d4a81d13ba03901d1b9d4d421b599d402f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d9741c4d066a0b05c8ca88a199e3c1562972200fe3b47ec6069e6ad1c98350eb1594fe4ebd5d6ae384c33cade737c24b0ecad4dd78fea8ef8908936d5c227076

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a8ef4519ed96fe07e9fd5e967a702a2e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          73ed8a377425393303ba3146edbad7fe075ad07c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          ed699aba31d30bc8995636467ff538fc65a4e4bb9a6ee1f4237ea4ff2939afdb

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5f82291eb1be966aa3ff865571f862dc0576f8ceefc135164add217aae93d171ca4aca5a4eae7cadcb9c6616925d632d50e680f0fc5c2bbdc4cbae2e8941fd1b

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a8ef4519ed96fe07e9fd5e967a702a2e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          73ed8a377425393303ba3146edbad7fe075ad07c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          ed699aba31d30bc8995636467ff538fc65a4e4bb9a6ee1f4237ea4ff2939afdb

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5f82291eb1be966aa3ff865571f862dc0576f8ceefc135164add217aae93d171ca4aca5a4eae7cadcb9c6616925d632d50e680f0fc5c2bbdc4cbae2e8941fd1b

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7deabd60f1edc4dd078a6371654b5fa0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          318a575a67884001fde224d6697d0415e0d6e903

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          af6485f7a703e7b63e0bd370fa6a94712de0f29b66651d833b9278213a241676

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          7796cdc907238e000dac79001dfde1ac2ad35a0265fdfa12e30e0dae106e80e393b5d64ae9b3a5ee5772831778f4dcdbcb32fb58445291ee563bd2e61776a24b

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7deabd60f1edc4dd078a6371654b5fa0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          318a575a67884001fde224d6697d0415e0d6e903

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          af6485f7a703e7b63e0bd370fa6a94712de0f29b66651d833b9278213a241676

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          7796cdc907238e000dac79001dfde1ac2ad35a0265fdfa12e30e0dae106e80e393b5d64ae9b3a5ee5772831778f4dcdbcb32fb58445291ee563bd2e61776a24b

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          f4594b44aa0efd4d920596f6b4dde0cc

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          1bb3613dd9bf67da04c51c51010520a46e8ab904

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a6c442149ded3c207d53beb45d47e69515a000ef14ace4854fb97b954268a2ef

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          038c3ca112787c8bbea6142599e3c6e2f294f9f098ffb9ef44c228c13dc0d7ab3f027032a274f164249abb941426f21188c0d93960e749415eabdde4071e1653

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          f4594b44aa0efd4d920596f6b4dde0cc

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          1bb3613dd9bf67da04c51c51010520a46e8ab904

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a6c442149ded3c207d53beb45d47e69515a000ef14ace4854fb97b954268a2ef

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          038c3ca112787c8bbea6142599e3c6e2f294f9f098ffb9ef44c228c13dc0d7ab3f027032a274f164249abb941426f21188c0d93960e749415eabdde4071e1653

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          c1de468b5ad1b27137174a3091f20df0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          97c162009ec32db54a0473bb011caa5fceee8ff4

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          915be912ed564e3f6dbf51353fd773febf73980885d9c562e1e06adabdbe216c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          202fa3c72e06e89096d3d178476edb78de8d2a13bafd163bc5991da38c5e9660dfcf3000f8cf790445e07340e979b31cbc9eb3dc191c091f68882048226367c9

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          c1de468b5ad1b27137174a3091f20df0

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          97c162009ec32db54a0473bb011caa5fceee8ff4

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          915be912ed564e3f6dbf51353fd773febf73980885d9c562e1e06adabdbe216c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          202fa3c72e06e89096d3d178476edb78de8d2a13bafd163bc5991da38c5e9660dfcf3000f8cf790445e07340e979b31cbc9eb3dc191c091f68882048226367c9

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          876ecb37b92e27ff55cfbad0c23a60cd

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          889348fa9678227b0e70f1209899a9a258034c25

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1e524caa11ce7f24ec6d1b2fce7142dcc522b4c7f7611140e392f7965de12847

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          192b1f27c39179ba70fcba384dfc1e11ba5bf98b0f25785b6bc615812df32c7d50ad29e245b7c758c7bc62f34e13b3c4dd56723c0beea8526dd859bed9db8cac

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          876ecb37b92e27ff55cfbad0c23a60cd

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          889348fa9678227b0e70f1209899a9a258034c25

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1e524caa11ce7f24ec6d1b2fce7142dcc522b4c7f7611140e392f7965de12847

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          192b1f27c39179ba70fcba384dfc1e11ba5bf98b0f25785b6bc615812df32c7d50ad29e245b7c758c7bc62f34e13b3c4dd56723c0beea8526dd859bed9db8cac

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a8ef4519ed96fe07e9fd5e967a702a2e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          73ed8a377425393303ba3146edbad7fe075ad07c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          ed699aba31d30bc8995636467ff538fc65a4e4bb9a6ee1f4237ea4ff2939afdb

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5f82291eb1be966aa3ff865571f862dc0576f8ceefc135164add217aae93d171ca4aca5a4eae7cadcb9c6616925d632d50e680f0fc5c2bbdc4cbae2e8941fd1b

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a8ef4519ed96fe07e9fd5e967a702a2e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          73ed8a377425393303ba3146edbad7fe075ad07c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          ed699aba31d30bc8995636467ff538fc65a4e4bb9a6ee1f4237ea4ff2939afdb

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5f82291eb1be966aa3ff865571f862dc0576f8ceefc135164add217aae93d171ca4aca5a4eae7cadcb9c6616925d632d50e680f0fc5c2bbdc4cbae2e8941fd1b

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          876ecb37b92e27ff55cfbad0c23a60cd

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          889348fa9678227b0e70f1209899a9a258034c25

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1e524caa11ce7f24ec6d1b2fce7142dcc522b4c7f7611140e392f7965de12847

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          192b1f27c39179ba70fcba384dfc1e11ba5bf98b0f25785b6bc615812df32c7d50ad29e245b7c758c7bc62f34e13b3c4dd56723c0beea8526dd859bed9db8cac

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          876ecb37b92e27ff55cfbad0c23a60cd

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          889348fa9678227b0e70f1209899a9a258034c25

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1e524caa11ce7f24ec6d1b2fce7142dcc522b4c7f7611140e392f7965de12847

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          192b1f27c39179ba70fcba384dfc1e11ba5bf98b0f25785b6bc615812df32c7d50ad29e245b7c758c7bc62f34e13b3c4dd56723c0beea8526dd859bed9db8cac

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          eff176ecba6aeef10e83725622b4b75e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          7e63ff1857d611991f5f8d2799e8c16ce7d90a9c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          61dc0e008e80475b2cb78c3ac4dee399572d8fae42f09a766d4256f17fd43578

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fecb3c06f4ff206c7fc3c40a2881c3b71ae319907613c1a0acd8c1d1eee6243b7b63ab35ea1a72022ad031988e698a96aaa1d41c2a76b62d7995a10ec9b3932c

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          eff176ecba6aeef10e83725622b4b75e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          7e63ff1857d611991f5f8d2799e8c16ce7d90a9c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          61dc0e008e80475b2cb78c3ac4dee399572d8fae42f09a766d4256f17fd43578

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fecb3c06f4ff206c7fc3c40a2881c3b71ae319907613c1a0acd8c1d1eee6243b7b63ab35ea1a72022ad031988e698a96aaa1d41c2a76b62d7995a10ec9b3932c

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          eff176ecba6aeef10e83725622b4b75e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          7e63ff1857d611991f5f8d2799e8c16ce7d90a9c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          61dc0e008e80475b2cb78c3ac4dee399572d8fae42f09a766d4256f17fd43578

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fecb3c06f4ff206c7fc3c40a2881c3b71ae319907613c1a0acd8c1d1eee6243b7b63ab35ea1a72022ad031988e698a96aaa1d41c2a76b62d7995a10ec9b3932c

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          eff176ecba6aeef10e83725622b4b75e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          7e63ff1857d611991f5f8d2799e8c16ce7d90a9c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          61dc0e008e80475b2cb78c3ac4dee399572d8fae42f09a766d4256f17fd43578

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fecb3c06f4ff206c7fc3c40a2881c3b71ae319907613c1a0acd8c1d1eee6243b7b63ab35ea1a72022ad031988e698a96aaa1d41c2a76b62d7995a10ec9b3932c

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5e80ac16275d80e58220c60344cf7b1b

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          82d3e5fd339bc75494a02c24af83d313b44bd044

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          397700dd21dd68aa00e259ffdd567e5cdecca07cd8a49d03ef9010a557a1523d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9011cb02d1a7052d182798f53ee547a8bbae67e74b183491611021754772794578e449cb390cfcb68b4d70a362c5ce60c775338da083de45a6b1ac7db18d4f9f

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5e80ac16275d80e58220c60344cf7b1b

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          82d3e5fd339bc75494a02c24af83d313b44bd044

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          397700dd21dd68aa00e259ffdd567e5cdecca07cd8a49d03ef9010a557a1523d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9011cb02d1a7052d182798f53ee547a8bbae67e74b183491611021754772794578e449cb390cfcb68b4d70a362c5ce60c775338da083de45a6b1ac7db18d4f9f

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          82a9f28a09aa1efa64498b6ed7e3ff7a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          f7e1961b224bf7fedab20cea4135c339dc35648a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          94bb9d143599a93d254e6bc2121658a18affd27d79f229476e57343c1191d112

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          923e1caa07eb55c5b5747d4baada9ad5d3cab355815c6779a733f64c57c767bab49475bf09893f1aede6f44152d9819d815646f8a75b2ee6983651ab937d8b0f

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          82a9f28a09aa1efa64498b6ed7e3ff7a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          f7e1961b224bf7fedab20cea4135c339dc35648a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          94bb9d143599a93d254e6bc2121658a18affd27d79f229476e57343c1191d112

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          923e1caa07eb55c5b5747d4baada9ad5d3cab355815c6779a733f64c57c767bab49475bf09893f1aede6f44152d9819d815646f8a75b2ee6983651ab937d8b0f

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Google\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9f0f3e2078bb0769308d5132ed37ae5c

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          5c7c9f9fd1ca71403328ba0c8730bb61d605769e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          4e68592f8d19afe1759e1f257a9f1c9bb9d3743001156b42c22e05ee2e2de668

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          f4d37e6c456e866f6b1b50c154b4bc527917ac400b21c641abf2c1195f0b3bdcb6183ab025754182474d1795fa5dbfe2ca7dfcace00fc07cf30285b41373d1fb

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Google\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9f0f3e2078bb0769308d5132ed37ae5c

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          5c7c9f9fd1ca71403328ba0c8730bb61d605769e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          4e68592f8d19afe1759e1f257a9f1c9bb9d3743001156b42c22e05ee2e2de668

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          f4d37e6c456e866f6b1b50c154b4bc527917ac400b21c641abf2c1195f0b3bdcb6183ab025754182474d1795fa5dbfe2ca7dfcace00fc07cf30285b41373d1fb

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Internet Explorer\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          ab6fa2c6546b7c6f72b1b398c5f5f514

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          93a8c7465010b988168738ba07d60f6e04e7d0c5

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c9eca6ce4e80905c694ef272fe2baf65c9ef0a46bec4af86d06b481876b41e75

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          3062eab57239367d59da688f0d493e98988db36127cbe29812e684a0be96589500dfbade2aab555ba6482eb4c31969eab638e0e9f9a8df8984014697d05fbbc5

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Internet Explorer\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          ab6fa2c6546b7c6f72b1b398c5f5f514

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          93a8c7465010b988168738ba07d60f6e04e7d0c5

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c9eca6ce4e80905c694ef272fe2baf65c9ef0a46bec4af86d06b481876b41e75

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          3062eab57239367d59da688f0d493e98988db36127cbe29812e684a0be96589500dfbade2aab555ba6482eb4c31969eab638e0e9f9a8df8984014697d05fbbc5

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          042ba4b9ed7abfd3ff87ce7dc6536701

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          11e27f860b1c15f839a58ae5c58160cecf19f5bc

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9153c463327172ea24a1f5e7d7a00a19e68ab900c604677109d9745809efae32

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          626fdd4d0952b5f5f0156e2a5aa59836a6d8365c1a82e82c63608271853637b6d2e0ed7f9e8e795cacac9f1d63e06576fec179faa085c65d607d82c8403f0e13

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          042ba4b9ed7abfd3ff87ce7dc6536701

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          11e27f860b1c15f839a58ae5c58160cecf19f5bc

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9153c463327172ea24a1f5e7d7a00a19e68ab900c604677109d9745809efae32

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          626fdd4d0952b5f5f0156e2a5aa59836a6d8365c1a82e82c63608271853637b6d2e0ed7f9e8e795cacac9f1d63e06576fec179faa085c65d607d82c8403f0e13

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3156363225\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3156363225\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4472e36379c0425bbacffa6162f14c0a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          06654b618adff89b68dcae69ae5ce52070491053

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a2c36923a874c6b0912a158efbb6053741ad032d599a058c9219dbcecdeae032

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ff158c6ec11911a3b8621903540bf3e32f5d3e25c2267fb9b0a7744460897086502a314a0cee5140a0671e29ab807414cc48677c742c5b716be500d44a895c79

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\data.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4472e36379c0425bbacffa6162f14c0a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          06654b618adff89b68dcae69ae5ce52070491053

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a2c36923a874c6b0912a158efbb6053741ad032d599a058c9219dbcecdeae032

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ff158c6ec11911a3b8621903540bf3e32f5d3e25c2267fb9b0a7744460897086502a314a0cee5140a0671e29ab807414cc48677c742c5b716be500d44a895c79

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a10f2468cb07867cbb1fd0c33ee9df1

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          75c5b659e31455bab8e3f3a74659ae9df679bf8e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d31dd5fe75579abd83fad546d7e90e0a4c202c5faeb92d99ae255ebc2808357e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e69b4ba9f451791c40908a6633fee198f3b2e90c337a9a8b016f19bacc3265627f86bcf3782f165fdfa8fe8f30738d6769ac6c7dbf88733f3676b3c2cd360751

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4472e36379c0425bbacffa6162f14c0a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          06654b618adff89b68dcae69ae5ce52070491053

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a2c36923a874c6b0912a158efbb6053741ad032d599a058c9219dbcecdeae032

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ff158c6ec11911a3b8621903540bf3e32f5d3e25c2267fb9b0a7744460897086502a314a0cee5140a0671e29ab807414cc48677c742c5b716be500d44a895c79

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4472e36379c0425bbacffa6162f14c0a

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          06654b618adff89b68dcae69ae5ce52070491053

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a2c36923a874c6b0912a158efbb6053741ad032d599a058c9219dbcecdeae032

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ff158c6ec11911a3b8621903540bf3e32f5d3e25c2267fb9b0a7744460897086502a314a0cee5140a0671e29ab807414cc48677c742c5b716be500d44a895c79

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a2efa1e7487dfc8f449d33c25353ee94

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          e02768875176df0dc488f7bc39ba7808de27e295

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c1c493a14d8c9f647cf6e1990f6198477d45f1fec835babb65dcd108bcb99624

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          0502af49ee48d6602f438baf829ec37707d1bacd00328c7c21e0acd600405a71330026d47658c3e84c08ab2eaf63f60d3af596ebd505198adfd3112dda7d065e

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a2efa1e7487dfc8f449d33c25353ee94

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          e02768875176df0dc488f7bc39ba7808de27e295

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          c1c493a14d8c9f647cf6e1990f6198477d45f1fec835babb65dcd108bcb99624

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          0502af49ee48d6602f438baf829ec37707d1bacd00328c7c21e0acd600405a71330026d47658c3e84c08ab2eaf63f60d3af596ebd505198adfd3112dda7d065e

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          f32c1cd988719547d396b381abef445d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          748f534ff737d03305f831eb9b808d0f9de63306

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          13c9735f4db281044ed7e02f9ea582826b28ea6bf267a794409b733c4d983f1e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          c93db1fe5fda8bc70141ae49984c351e303a4bb80f091eada364c815b34e4fffa1eeca4e27190837fbecfc9c3e04426b8ac55044e7b1797f894dc76ce9ba4678

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          f32c1cd988719547d396b381abef445d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          748f534ff737d03305f831eb9b808d0f9de63306

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          13c9735f4db281044ed7e02f9ea582826b28ea6bf267a794409b733c4d983f1e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          c93db1fe5fda8bc70141ae49984c351e303a4bb80f091eada364c815b34e4fffa1eeca4e27190837fbecfc9c3e04426b8ac55044e7b1797f894dc76ce9ba4678

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\odt\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e3d67439eed965ed097bcf4ddfd58812

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          6e9dce955864a4cd80d36a7dec2dd602e1d31d27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          7c59c33b6f391b0c0aded0f8a8357e7e425294cfbc2725f7f13823b80b220a3a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e35e305d6f6c102dec2a2640bbeed4c4da8a23cd4b5d530fcde7dad0150f64f306cbf4bfbf50710ed60a0a21ca9e01f4233c8381ece9b25df1847e847fd22be2

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\odt\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e3d67439eed965ed097bcf4ddfd58812

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          6e9dce955864a4cd80d36a7dec2dd602e1d31d27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          7c59c33b6f391b0c0aded0f8a8357e7e425294cfbc2725f7f13823b80b220a3a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e35e305d6f6c102dec2a2640bbeed4c4da8a23cd4b5d530fcde7dad0150f64f306cbf4bfbf50710ed60a0a21ca9e01f4233c8381ece9b25df1847e847fd22be2

                                                                                                                                                                                                          Download Submit