Analysis
-
max time kernel
0s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
13-11-2023 05:32
Behavioral task
behavioral1
Sample
NEAS.64f6c5e43198859db34179165ff78f60.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.64f6c5e43198859db34179165ff78f60.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.64f6c5e43198859db34179165ff78f60.exe
-
Size
122KB
-
MD5
64f6c5e43198859db34179165ff78f60
-
SHA1
d13fcf22d76196072308ae94839ab6eff08df52f
-
SHA256
f9473c69abf879f447d2fc20a1503576de823a91490d66f08dc3cc7bf621df03
-
SHA512
ae344f30b567b72c093ea43bf001b0084695c6cb21a1e147400edc41206fcea20560a43c2a21c466e287f271085b74a4f4e8b8c9d266050f0b3536f834f9dd0e
-
SSDEEP
1536:lvm1Fu8AjYaFwjRUdW7fmyY7aZYJVmy0KQbj6vbjuKoauGi4z:6u8ANCUdgfmD7zey0KUj6TjR9i4z
Malware Config
Signatures
-
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/892-0-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2940-13-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2676-25-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/files/0x0008000000015c2e-24.dat family_berbew behavioral1/files/0x0007000000015c63-36.dat family_berbew behavioral1/files/0x0008000000015c4d-48.dat family_berbew behavioral1/memory/2756-63-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/files/0x0009000000015c6c-71.dat family_berbew behavioral1/memory/2940-73-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/files/0x0007000000015cb3-83.dat family_berbew behavioral1/memory/3032-87-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/892-84-0x00000000002F0000-0x0000000000314000-memory.dmp family_berbew behavioral1/files/0x0007000000015cb3-79.dat family_berbew behavioral1/files/0x0007000000015cb3-77.dat family_berbew behavioral1/memory/2572-76-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/files/0x0009000000015c6c-67.dat family_berbew behavioral1/memory/892-66-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/files/0x0009000000015c6c-64.dat family_berbew behavioral1/memory/2772-123-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/files/0x0006000000015eb5-135.dat family_berbew behavioral1/files/0x000600000001605c-143.dat family_berbew behavioral1/files/0x000600000001605c-147.dat family_berbew behavioral1/files/0x0006000000016064-159.dat family_berbew behavioral1/files/0x0006000000016064-155.dat family_berbew behavioral1/files/0x00060000000162e3-166.dat family_berbew behavioral1/files/0x00060000000162e3-173.dat family_berbew behavioral1/files/0x0007000000016454-186.dat family_berbew behavioral1/files/0x0007000000016454-192.dat family_berbew behavioral1/files/0x000600000001659c-194.dat family_berbew behavioral1/files/0x000600000001659c-201.dat family_berbew behavioral1/files/0x000600000001659c-204.dat family_berbew behavioral1/files/0x0006000000016baa-218.dat family_berbew behavioral1/memory/2124-237-0x0000000000280000-0x00000000002A4000-memory.dmp family_berbew behavioral1/files/0x0006000000016c26-238.dat family_berbew behavioral1/files/0x0006000000016c36-246.dat family_berbew behavioral1/files/0x0006000000016c36-251.dat family_berbew behavioral1/files/0x0006000000016ca4-257.dat family_berbew behavioral1/memory/2376-283-0x0000000000290000-0x00000000002B4000-memory.dmp family_berbew behavioral1/memory/1932-287-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/1892-295-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2728-379-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2124-385-0x0000000000280000-0x00000000002A4000-memory.dmp family_berbew behavioral1/memory/2708-396-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/1040-405-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2912-415-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2956-426-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2680-435-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2124-448-0x0000000000280000-0x00000000002A4000-memory.dmp family_berbew behavioral1/memory/1184-461-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2136-496-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/1144-512-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/836-527-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/1104-520-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2124-568-0x0000000000280000-0x00000000002A4000-memory.dmp family_berbew behavioral1/memory/1696-597-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2820-629-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2124-646-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2360-666-0x0000000000430000-0x0000000000454000-memory.dmp family_berbew behavioral1/memory/2360-691-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2360-704-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/344-725-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/1460-726-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/1988-695-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew behavioral1/memory/2120-686-0x0000000000400000-0x0000000000424000-memory.dmp family_berbew -
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" NEAS.64f6c5e43198859db34179165ff78f60.exe Set value (int) \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 1 IoCs
pid Process 2940 backup.exe -
Loads dropped DLL 3 IoCs
pid Process 892 NEAS.64f6c5e43198859db34179165ff78f60.exe 892 NEAS.64f6c5e43198859db34179165ff78f60.exe 892 NEAS.64f6c5e43198859db34179165ff78f60.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 892 NEAS.64f6c5e43198859db34179165ff78f60.exe 2940 backup.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 892 wrote to memory of 2940 892 NEAS.64f6c5e43198859db34179165ff78f60.exe 163 PID 892 wrote to memory of 2940 892 NEAS.64f6c5e43198859db34179165ff78f60.exe 163 PID 892 wrote to memory of 2940 892 NEAS.64f6c5e43198859db34179165ff78f60.exe 163 PID 892 wrote to memory of 2940 892 NEAS.64f6c5e43198859db34179165ff78f60.exe 163 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NEAS.64f6c5e43198859db34179165ff78f60.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" NEAS.64f6c5e43198859db34179165ff78f60.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.64f6c5e43198859db34179165ff78f60.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.64f6c5e43198859db34179165ff78f60.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:892 -
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵PID:3032
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵PID:2572
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵PID:2676
-
-
C:\Users\Admin\AppData\Local\Temp\1696401815\backup.exeC:\Users\Admin\AppData\Local\Temp\1696401815\backup.exe C:\Users\Admin\AppData\Local\Temp\1696401815\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2940
-
-
C:\backup.exe\backup.exe \1⤵PID:2080
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\2⤵PID:2128
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\3⤵PID:2596
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\4⤵PID:2728
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\5⤵PID:1424
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\5⤵PID:1676
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\6⤵PID:1632
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\6⤵PID:1432
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\6⤵PID:844
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\6⤵PID:756
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\6⤵PID:2620
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\6⤵PID:1596
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\6⤵PID:1156
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\6⤵PID:2272
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\7⤵PID:2512
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\7⤵PID:1584
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\8⤵PID:3008
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\7⤵PID:564
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\7⤵PID:2688
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\6⤵PID:1448
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\7⤵PID:2784
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\6⤵PID:2652
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\6⤵PID:2312
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\5⤵PID:1648
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\6⤵PID:2212
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\6⤵PID:2124
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\6⤵PID:2748
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\6⤵PID:2656
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\6⤵PID:2240
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\5⤵PID:2996
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\6⤵PID:2916
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\3⤵PID:2288
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\4⤵PID:2460
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\5⤵PID:1352
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\5⤵PID:2976
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\5⤵PID:2516
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\4⤵PID:2220
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\5⤵PID:1500
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\6⤵PID:2928
-
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\4⤵PID:1564
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\4⤵PID:608
-
C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\5⤵PID:2356
-
-
C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\5⤵PID:1524
-
-
C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\data.exe"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\data.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\5⤵PID:912
-
C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\6⤵PID:2656
-
-
-
C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\5⤵PID:1172
-
-
C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\5⤵PID:1220
-
-
C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\5⤵PID:2012
-
-
C:\Program Files (x86)\Common Files\microsoft shared\Help\update.exe"C:\Program Files (x86)\Common Files\microsoft shared\Help\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\5⤵PID:2892
-
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\4⤵PID:3044
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\4⤵PID:2788
-
-
C:\Program Files (x86)\Common Files\System\System Restore.exe"C:\Program Files (x86)\Common Files\System\System Restore.exe" C:\Program Files (x86)\Common Files\System\4⤵PID:3036
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\3⤵PID:860
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\3⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft Analysis Services\data.exe"C:\Program Files (x86)\Microsoft Analysis Services\data.exe" C:\Program Files (x86)\Microsoft Analysis Services\3⤵PID:1612
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\3⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\3⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\3⤵PID:1580
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\4⤵PID:832
-
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\update.exe"C:\Program Files (x86)\Microsoft Synchronization Services\update.exe" C:\Program Files (x86)\Microsoft Synchronization Services\3⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\3⤵PID:588
-
-
C:\Program Files (x86)\Microsoft.NET\backup.exe"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\3⤵PID:2000
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\2⤵PID:2508
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\3⤵PID:2084
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\3⤵PID:1872
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\4⤵PID:2672
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\4⤵PID:2904
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\4⤵PID:2232
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\4⤵PID:2520
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\4⤵PID:2796
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\4⤵PID:2760
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\4⤵PID:2472
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\4⤵PID:2156
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\3⤵PID:2708
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\3⤵PID:1016
-
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\4⤵PID:2624
-
C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe"C:\Program Files\Microsoft Games\Chess\de-DE\backup.exe" C:\Program Files\Microsoft Games\Chess\de-DE\5⤵PID:2132
-
-
C:\Program Files\Microsoft Games\Chess\en-US\backup.exe"C:\Program Files\Microsoft Games\Chess\en-US\backup.exe" C:\Program Files\Microsoft Games\Chess\en-US\5⤵PID:2896
-
-
C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe"C:\Program Files\Microsoft Games\Chess\es-ES\backup.exe" C:\Program Files\Microsoft Games\Chess\es-ES\5⤵PID:952
-
-
C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe"C:\Program Files\Microsoft Games\Chess\fr-FR\backup.exe" C:\Program Files\Microsoft Games\Chess\fr-FR\5⤵PID:1768
-
-
C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe"C:\Program Files\Microsoft Games\Chess\it-IT\backup.exe" C:\Program Files\Microsoft Games\Chess\it-IT\5⤵PID:2916
-
-
-
C:\Program Files\Microsoft Games\FreeCell\backup.exe"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\4⤵PID:1000
-
C:\Program Files\Microsoft Games\FreeCell\de-DE\data.exe"C:\Program Files\Microsoft Games\FreeCell\de-DE\data.exe" C:\Program Files\Microsoft Games\FreeCell\de-DE\5⤵PID:2080
-
-
C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe"C:\Program Files\Microsoft Games\FreeCell\en-US\backup.exe" C:\Program Files\Microsoft Games\FreeCell\en-US\5⤵PID:2540
-
-
C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe"C:\Program Files\Microsoft Games\FreeCell\es-ES\backup.exe" C:\Program Files\Microsoft Games\FreeCell\es-ES\5⤵PID:2060
-
-
C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe"C:\Program Files\Microsoft Games\FreeCell\fr-FR\backup.exe" C:\Program Files\Microsoft Games\FreeCell\fr-FR\5⤵PID:2724
-
-
-
C:\Program Files\Microsoft Games\Hearts\backup.exe"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\4⤵PID:2636
-
-
C:\Program Files\Microsoft Games\Mahjong\data.exe"C:\Program Files\Microsoft Games\Mahjong\data.exe" C:\Program Files\Microsoft Games\Mahjong\4⤵PID:1292
-
-
C:\Program Files\Microsoft Games\Minesweeper\backup.exe"C:\Program Files\Microsoft Games\Minesweeper\backup.exe" C:\Program Files\Microsoft Games\Minesweeper\4⤵PID:2348
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\3⤵PID:1960
-
-
C:\Program Files\Mozilla Firefox\data.exe"C:\Program Files\Mozilla Firefox\data.exe" C:\Program Files\Mozilla Firefox\3⤵PID:1424
-
C:\Program Files\Mozilla Firefox\browser\backup.exe"C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\4⤵PID:1496
-
-
C:\Program Files\Mozilla Firefox\defaults\backup.exe"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\4⤵PID:328
-
-
C:\Program Files\Mozilla Firefox\fonts\backup.exe"C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\4⤵PID:928
-
-
C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe"C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\4⤵PID:2680
-
-
C:\Program Files\Mozilla Firefox\uninstall\backup.exe"C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\4⤵PID:1452
-
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\3⤵PID:2372
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\3⤵PID:1784
-
C:\Program Files\Reference Assemblies\Microsoft\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\4⤵PID:2556
-
-
-
C:\Program Files\VideoLAN\data.exe"C:\Program Files\VideoLAN\data.exe" C:\Program Files\VideoLAN\3⤵PID:2828
-
-
C:\Program Files\Windows Defender\backup.exe"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\3⤵PID:792
-
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\2⤵PID:1640
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\2⤵PID:1956
-
C:\Users\Admin\data.exeC:\Users\Admin\data.exe C:\Users\Admin\3⤵PID:1700
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\4⤵PID:1932
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\4⤵PID:2864
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\4⤵PID:3012
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\4⤵PID:2552
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\4⤵PID:3052
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\4⤵PID:1040
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\4⤵PID:1096
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\4⤵PID:268
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\4⤵PID:900
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\4⤵PID:2056
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\4⤵PID:1448
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\3⤵PID:1592
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\4⤵PID:2812
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\4⤵PID:2292
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\4⤵PID:524
-
C:\Users\Public\Music\Sample Music\backup.exe"C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\5⤵PID:1660
-
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\4⤵PID:2556
-
C:\Users\Public\Pictures\Sample Pictures\backup.exe"C:\Users\Public\Pictures\Sample Pictures\backup.exe" C:\Users\Public\Pictures\Sample Pictures\5⤵PID:2480
-
-
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\4⤵PID:2872
-
C:\Users\Public\Recorded TV\Sample Media\backup.exe"C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\5⤵PID:1512
-
-
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\4⤵PID:2028
-
C:\Users\Public\Videos\Sample Videos\backup.exe"C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\5⤵PID:2296
-
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\2⤵PID:2164
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\3⤵PID:2012
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\3⤵PID:240
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\3⤵PID:1360
-
C:\Windows\AppPatch\AppPatch64\backup.exeC:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\4⤵PID:2644
-
-
C:\Windows\AppPatch\Custom\backup.exeC:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\4⤵PID:980
-
C:\Windows\AppPatch\Custom\Custom64\backup.exeC:\Windows\AppPatch\Custom\Custom64\backup.exe C:\Windows\AppPatch\Custom\Custom64\5⤵PID:2720
-
-
-
C:\Windows\AppPatch\de-DE\backup.exeC:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\4⤵PID:1492
-
-
C:\Windows\AppPatch\en-US\backup.exeC:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\4⤵PID:1500
-
-
C:\Windows\AppPatch\es-ES\backup.exeC:\Windows\AppPatch\es-ES\backup.exe C:\Windows\AppPatch\es-ES\4⤵PID:1664
-
-
C:\Windows\AppPatch\fr-FR\backup.exeC:\Windows\AppPatch\fr-FR\backup.exe C:\Windows\AppPatch\fr-FR\4⤵PID:3024
-
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\3⤵PID:2024
-
C:\Windows\assembly\GAC\System Restore.exe"C:\Windows\assembly\GAC\System Restore.exe" C:\Windows\assembly\GAC\4⤵PID:1540
-
-
C:\Windows\assembly\GAC_32\backup.exeC:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\4⤵PID:1616
-
C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exeC:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\backup.exe C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\5⤵PID:2344
-
-
C:\Windows\assembly\GAC_32\BDATunePIA\backup.exeC:\Windows\assembly\GAC_32\BDATunePIA\backup.exe C:\Windows\assembly\GAC_32\BDATunePIA\5⤵PID:1104
-
-
C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exeC:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\5⤵PID:3040
-
-
-
C:\Windows\assembly\GAC_64\backup.exeC:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\4⤵PID:1608
-
-
C:\Windows\assembly\GAC_MSIL\backup.exeC:\Windows\assembly\GAC_MSIL\backup.exe C:\Windows\assembly\GAC_MSIL\4⤵PID:1576
-
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\3⤵PID:1944
-
-
C:\Windows\CSC\System Restore.exe"C:\Windows\CSC\System Restore.exe" C:\Windows\CSC\3⤵PID:2136
-
-
C:\Windows\Cursors\backup.exeC:\Windows\Cursors\backup.exe C:\Windows\Cursors\3⤵PID:1604
-
-
C:\Windows\debug\backup.exeC:\Windows\debug\backup.exe C:\Windows\debug\3⤵PID:1628
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\1⤵PID:2808
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\1⤵PID:1932
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\1⤵PID:2996
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\1⤵PID:1716
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\1⤵PID:1588
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\1⤵PID:2680
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\2⤵PID:2728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\2⤵PID:2708
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\2⤵PID:1032
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\1⤵PID:1184
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\1⤵PID:1516
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\1⤵PID:2480
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\1⤵PID:2136
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\1⤵PID:832
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\1⤵PID:1144
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\1⤵PID:1104
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\1⤵PID:836
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\1⤵PID:2232
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\1⤵PID:900
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\1⤵PID:2180
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\1⤵PID:1316
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\1⤵PID:1696
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\1⤵PID:2344
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\1⤵PID:2676
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\1⤵PID:2820
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\1⤵PID:2360
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\2⤵PID:2632
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\2⤵PID:2788
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\2⤵PID:2120
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\2⤵PID:1020
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\2⤵PID:1988
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\2⤵PID:2888
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1⤵PID:1460
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\2⤵PID:344
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\1⤵PID:2856
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\1⤵PID:1292
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\1⤵PID:1904
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\2⤵PID:1332
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\2⤵PID:2072
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\2⤵PID:632
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\2⤵PID:1244
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\2⤵PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\2⤵PID:1628
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\1⤵PID:2808
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\2⤵PID:604
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\2⤵PID:2528
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\2⤵PID:2184
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\2⤵PID:980
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\2⤵PID:1692
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\2⤵PID:2648
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\1⤵PID:1584
-
C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\1⤵PID:2040
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\1⤵PID:1644
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\2⤵PID:2560
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\3⤵PID:2620
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\1⤵PID:3040
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\1⤵PID:1796
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\2⤵PID:2604
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\1⤵PID:2876
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\2⤵PID:240
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\3⤵PID:1632
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\3⤵PID:2008
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\3⤵PID:2296
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\3⤵PID:2076
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\3⤵PID:1192
-
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\3⤵PID:2224
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\2⤵PID:2968
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\2⤵PID:844
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\2⤵PID:2636
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\2⤵PID:2072
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\2⤵PID:2972
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\2⤵PID:1824
-
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\3⤵PID:740
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\3⤵PID:1628
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\3⤵PID:900
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\3⤵PID:1884
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\3⤵PID:604
-
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\3⤵PID:2116
-
-
-
C:\Program Files\Common Files\System\ja-JP\System Restore.exe"C:\Program Files\Common Files\System\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ja-JP\2⤵PID:2412
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\2⤵PID:1892
-
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\3⤵PID:2996
-
-
C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\3⤵PID:2864
-
-
C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\3⤵PID:1764
-
-
C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\3⤵PID:2768
-
-
C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\3⤵PID:2640
-
-
C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\3⤵PID:548
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\1⤵PID:2520
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\2⤵PID:2632
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\2⤵PID:2680
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\3⤵PID:2956
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\3⤵PID:2912
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\3⤵PID:1040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\3⤵PID:2624
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\3⤵PID:2732
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\3⤵PID:2608
-
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\2⤵PID:2860
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\2⤵PID:388
-
-
C:\Program Files\DVD Maker\it-IT\data.exe"C:\Program Files\DVD Maker\it-IT\data.exe" C:\Program Files\DVD Maker\it-IT\2⤵PID:240
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\2⤵PID:2480
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\2⤵PID:1264
-
C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\3⤵PID:2808
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\1⤵PID:2688
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\1⤵PID:2792
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\1⤵PID:1716
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\1⤵PID:860
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\1⤵PID:2164
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\1⤵PID:1820
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\1⤵PID:1364
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\1⤵PID:2012
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\1⤵PID:1668
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\1⤵PID:2768
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\1⤵PID:1696
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\1⤵PID:1892
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\1⤵PID:740
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\1⤵PID:1912
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\1⤵PID:2288
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\1⤵PID:2124
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\1⤵PID:1204
-
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\1⤵PID:2376
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\1⤵PID:1508
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\1⤵PID:2480
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\1⤵PID:2748
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\1⤵PID:1036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD5d8ad63de4a4fc5ce472674e95742897e
SHA1a133bafc66cc1e0f3ff0c45402825e41e7df5618
SHA256f07fc918772f1326c243c0ae23e2fa309f4dd4aeef8c9e17ed4d54aac6f5ab25
SHA512c802f0c1c2283e97d36a8abb0dd8f72712c5cf8f08c149d4c03a3d6ba52487612c3646bd991a70b64bba386c93454802a9f4d8185566a6f8a88a875ec1897825
-
Filesize
122KB
MD5d8ad63de4a4fc5ce472674e95742897e
SHA1a133bafc66cc1e0f3ff0c45402825e41e7df5618
SHA256f07fc918772f1326c243c0ae23e2fa309f4dd4aeef8c9e17ed4d54aac6f5ab25
SHA512c802f0c1c2283e97d36a8abb0dd8f72712c5cf8f08c149d4c03a3d6ba52487612c3646bd991a70b64bba386c93454802a9f4d8185566a6f8a88a875ec1897825
-
Filesize
122KB
MD5ba786b1f25520e03885513a4bb130576
SHA1c8c377c03cf73a29d7a900145ac9273d8ce80c9d
SHA256b7d9140863af8f71896134cced1ad768839e5d1a61e250f38485526a497555ce
SHA5121096b6b7f0adde5eeec4f415a9224bc1bcf7b442d55b3e495aef7e0d539b3ed4273dab1c33da2727ecfd8d6374089e2ea960b691092ec87ed2932c6341fb3957
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD573a41ed7f01346bbffda7dae10091ea5
SHA16901e0cda5851146863c97c38e54620a96602bb8
SHA25673f060a234c53f5ae701d093ecde30d049c19c7f7654c7c38a57857b7f58e6c1
SHA512ad5267a3a68a17de0db1309079228f44f9c86c240d5bd5cc170375121773711a27cf8e59e9843aa678b4af3408a7cdbbd53f67eae18d879cdc338f7f5f17ddba
-
Filesize
122KB
MD5ba786b1f25520e03885513a4bb130576
SHA1c8c377c03cf73a29d7a900145ac9273d8ce80c9d
SHA256b7d9140863af8f71896134cced1ad768839e5d1a61e250f38485526a497555ce
SHA5121096b6b7f0adde5eeec4f415a9224bc1bcf7b442d55b3e495aef7e0d539b3ed4273dab1c33da2727ecfd8d6374089e2ea960b691092ec87ed2932c6341fb3957
-
Filesize
122KB
MD5ba786b1f25520e03885513a4bb130576
SHA1c8c377c03cf73a29d7a900145ac9273d8ce80c9d
SHA256b7d9140863af8f71896134cced1ad768839e5d1a61e250f38485526a497555ce
SHA5121096b6b7f0adde5eeec4f415a9224bc1bcf7b442d55b3e495aef7e0d539b3ed4273dab1c33da2727ecfd8d6374089e2ea960b691092ec87ed2932c6341fb3957
-
Filesize
122KB
MD5ac9a8575f3472c2d22cc87780d2bc357
SHA105dcd9aab735449546001e3be1704c1bfb61e712
SHA256d631878c91f06d200742352021792ebc71b4e831b859f77c601e28f7bca7d046
SHA512bdcf2af526c56acef611150685abc872ca13c2d5da1813f6e62dbb678aa4c04cfd4a034cca1ec4989a656b36ae506e143f5846a721501aa7c315ba94e8169c7d
-
Filesize
122KB
MD573a41ed7f01346bbffda7dae10091ea5
SHA16901e0cda5851146863c97c38e54620a96602bb8
SHA25673f060a234c53f5ae701d093ecde30d049c19c7f7654c7c38a57857b7f58e6c1
SHA512ad5267a3a68a17de0db1309079228f44f9c86c240d5bd5cc170375121773711a27cf8e59e9843aa678b4af3408a7cdbbd53f67eae18d879cdc338f7f5f17ddba
-
Filesize
122KB
MD573a41ed7f01346bbffda7dae10091ea5
SHA16901e0cda5851146863c97c38e54620a96602bb8
SHA25673f060a234c53f5ae701d093ecde30d049c19c7f7654c7c38a57857b7f58e6c1
SHA512ad5267a3a68a17de0db1309079228f44f9c86c240d5bd5cc170375121773711a27cf8e59e9843aa678b4af3408a7cdbbd53f67eae18d879cdc338f7f5f17ddba
-
Filesize
122KB
MD5ac9a8575f3472c2d22cc87780d2bc357
SHA105dcd9aab735449546001e3be1704c1bfb61e712
SHA256d631878c91f06d200742352021792ebc71b4e831b859f77c601e28f7bca7d046
SHA512bdcf2af526c56acef611150685abc872ca13c2d5da1813f6e62dbb678aa4c04cfd4a034cca1ec4989a656b36ae506e143f5846a721501aa7c315ba94e8169c7d
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD5d8ad63de4a4fc5ce472674e95742897e
SHA1a133bafc66cc1e0f3ff0c45402825e41e7df5618
SHA256f07fc918772f1326c243c0ae23e2fa309f4dd4aeef8c9e17ed4d54aac6f5ab25
SHA512c802f0c1c2283e97d36a8abb0dd8f72712c5cf8f08c149d4c03a3d6ba52487612c3646bd991a70b64bba386c93454802a9f4d8185566a6f8a88a875ec1897825
-
Filesize
122KB
MD5d8ad63de4a4fc5ce472674e95742897e
SHA1a133bafc66cc1e0f3ff0c45402825e41e7df5618
SHA256f07fc918772f1326c243c0ae23e2fa309f4dd4aeef8c9e17ed4d54aac6f5ab25
SHA512c802f0c1c2283e97d36a8abb0dd8f72712c5cf8f08c149d4c03a3d6ba52487612c3646bd991a70b64bba386c93454802a9f4d8185566a6f8a88a875ec1897825
-
Filesize
122KB
MD5ad5733588b07e6a14d808a9d328da052
SHA144523723f206185c1da1fb14950301a24e463122
SHA256fbbf2715ca1297da20cda1d5af4a521ad67021558bfd044d0e7ebb691737ae12
SHA5126f8b0cea408f465f0f3ffe57c9f374755c0c9407311cb4a3b9db94a11bde463222af3a31d628be479298e92b569d2eb6b1153e5ca1b90c053517417265827a29
-
Filesize
122KB
MD5ad5733588b07e6a14d808a9d328da052
SHA144523723f206185c1da1fb14950301a24e463122
SHA256fbbf2715ca1297da20cda1d5af4a521ad67021558bfd044d0e7ebb691737ae12
SHA5126f8b0cea408f465f0f3ffe57c9f374755c0c9407311cb4a3b9db94a11bde463222af3a31d628be479298e92b569d2eb6b1153e5ca1b90c053517417265827a29
-
Filesize
122KB
MD5ad5733588b07e6a14d808a9d328da052
SHA144523723f206185c1da1fb14950301a24e463122
SHA256fbbf2715ca1297da20cda1d5af4a521ad67021558bfd044d0e7ebb691737ae12
SHA5126f8b0cea408f465f0f3ffe57c9f374755c0c9407311cb4a3b9db94a11bde463222af3a31d628be479298e92b569d2eb6b1153e5ca1b90c053517417265827a29
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
41KB
MD5e3cade14a88ae1cdd6a659c9531a4e8d
SHA1e6f13784eff2dd8e7b53c4b3a4e1ca3edf00076c
SHA256e590f7aa892f596174aee7f7cd5f23c2e0e49578e0bc7c4602ddc116bf3ebcee
SHA512327b2bc58b5b3c6586b4b6922a461d56efd22946c255defd4281069af1d4c6e73ae4af78e0ab08becd12028ecc9932bde966f14f9c4b5674db2c1952b7ccf489
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
122KB
MD57e5dffa63a112a4c3a04f74829bd3240
SHA195f6bdfdd31b4da48013d5279e854be11a6c1863
SHA256e61aab4c6b87f10bcd538171a33f82d1af84f6c74a460942310b5e2b09287d99
SHA5122a5b0319b654eb04cb65aa08c63d2007412a8d962f71fea6f86665535b647188dffaa49110830f77c0d38d124de5d1ecebda50877f0e5325af3e16feb58ad09b
-
Filesize
122KB
MD57e5dffa63a112a4c3a04f74829bd3240
SHA195f6bdfdd31b4da48013d5279e854be11a6c1863
SHA256e61aab4c6b87f10bcd538171a33f82d1af84f6c74a460942310b5e2b09287d99
SHA5122a5b0319b654eb04cb65aa08c63d2007412a8d962f71fea6f86665535b647188dffaa49110830f77c0d38d124de5d1ecebda50877f0e5325af3e16feb58ad09b
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD5d8ad63de4a4fc5ce472674e95742897e
SHA1a133bafc66cc1e0f3ff0c45402825e41e7df5618
SHA256f07fc918772f1326c243c0ae23e2fa309f4dd4aeef8c9e17ed4d54aac6f5ab25
SHA512c802f0c1c2283e97d36a8abb0dd8f72712c5cf8f08c149d4c03a3d6ba52487612c3646bd991a70b64bba386c93454802a9f4d8185566a6f8a88a875ec1897825
-
Filesize
122KB
MD5d8ad63de4a4fc5ce472674e95742897e
SHA1a133bafc66cc1e0f3ff0c45402825e41e7df5618
SHA256f07fc918772f1326c243c0ae23e2fa309f4dd4aeef8c9e17ed4d54aac6f5ab25
SHA512c802f0c1c2283e97d36a8abb0dd8f72712c5cf8f08c149d4c03a3d6ba52487612c3646bd991a70b64bba386c93454802a9f4d8185566a6f8a88a875ec1897825
-
Filesize
122KB
MD5ba786b1f25520e03885513a4bb130576
SHA1c8c377c03cf73a29d7a900145ac9273d8ce80c9d
SHA256b7d9140863af8f71896134cced1ad768839e5d1a61e250f38485526a497555ce
SHA5121096b6b7f0adde5eeec4f415a9224bc1bcf7b442d55b3e495aef7e0d539b3ed4273dab1c33da2727ecfd8d6374089e2ea960b691092ec87ed2932c6341fb3957
-
Filesize
122KB
MD5ba786b1f25520e03885513a4bb130576
SHA1c8c377c03cf73a29d7a900145ac9273d8ce80c9d
SHA256b7d9140863af8f71896134cced1ad768839e5d1a61e250f38485526a497555ce
SHA5121096b6b7f0adde5eeec4f415a9224bc1bcf7b442d55b3e495aef7e0d539b3ed4273dab1c33da2727ecfd8d6374089e2ea960b691092ec87ed2932c6341fb3957
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD573a41ed7f01346bbffda7dae10091ea5
SHA16901e0cda5851146863c97c38e54620a96602bb8
SHA25673f060a234c53f5ae701d093ecde30d049c19c7f7654c7c38a57857b7f58e6c1
SHA512ad5267a3a68a17de0db1309079228f44f9c86c240d5bd5cc170375121773711a27cf8e59e9843aa678b4af3408a7cdbbd53f67eae18d879cdc338f7f5f17ddba
-
Filesize
122KB
MD573a41ed7f01346bbffda7dae10091ea5
SHA16901e0cda5851146863c97c38e54620a96602bb8
SHA25673f060a234c53f5ae701d093ecde30d049c19c7f7654c7c38a57857b7f58e6c1
SHA512ad5267a3a68a17de0db1309079228f44f9c86c240d5bd5cc170375121773711a27cf8e59e9843aa678b4af3408a7cdbbd53f67eae18d879cdc338f7f5f17ddba
-
Filesize
122KB
MD5ba786b1f25520e03885513a4bb130576
SHA1c8c377c03cf73a29d7a900145ac9273d8ce80c9d
SHA256b7d9140863af8f71896134cced1ad768839e5d1a61e250f38485526a497555ce
SHA5121096b6b7f0adde5eeec4f415a9224bc1bcf7b442d55b3e495aef7e0d539b3ed4273dab1c33da2727ecfd8d6374089e2ea960b691092ec87ed2932c6341fb3957
-
Filesize
122KB
MD5ba786b1f25520e03885513a4bb130576
SHA1c8c377c03cf73a29d7a900145ac9273d8ce80c9d
SHA256b7d9140863af8f71896134cced1ad768839e5d1a61e250f38485526a497555ce
SHA5121096b6b7f0adde5eeec4f415a9224bc1bcf7b442d55b3e495aef7e0d539b3ed4273dab1c33da2727ecfd8d6374089e2ea960b691092ec87ed2932c6341fb3957
-
Filesize
122KB
MD5ac9a8575f3472c2d22cc87780d2bc357
SHA105dcd9aab735449546001e3be1704c1bfb61e712
SHA256d631878c91f06d200742352021792ebc71b4e831b859f77c601e28f7bca7d046
SHA512bdcf2af526c56acef611150685abc872ca13c2d5da1813f6e62dbb678aa4c04cfd4a034cca1ec4989a656b36ae506e143f5846a721501aa7c315ba94e8169c7d
-
Filesize
122KB
MD5ac9a8575f3472c2d22cc87780d2bc357
SHA105dcd9aab735449546001e3be1704c1bfb61e712
SHA256d631878c91f06d200742352021792ebc71b4e831b859f77c601e28f7bca7d046
SHA512bdcf2af526c56acef611150685abc872ca13c2d5da1813f6e62dbb678aa4c04cfd4a034cca1ec4989a656b36ae506e143f5846a721501aa7c315ba94e8169c7d
-
Filesize
122KB
MD573a41ed7f01346bbffda7dae10091ea5
SHA16901e0cda5851146863c97c38e54620a96602bb8
SHA25673f060a234c53f5ae701d093ecde30d049c19c7f7654c7c38a57857b7f58e6c1
SHA512ad5267a3a68a17de0db1309079228f44f9c86c240d5bd5cc170375121773711a27cf8e59e9843aa678b4af3408a7cdbbd53f67eae18d879cdc338f7f5f17ddba
-
Filesize
122KB
MD573a41ed7f01346bbffda7dae10091ea5
SHA16901e0cda5851146863c97c38e54620a96602bb8
SHA25673f060a234c53f5ae701d093ecde30d049c19c7f7654c7c38a57857b7f58e6c1
SHA512ad5267a3a68a17de0db1309079228f44f9c86c240d5bd5cc170375121773711a27cf8e59e9843aa678b4af3408a7cdbbd53f67eae18d879cdc338f7f5f17ddba
-
Filesize
122KB
MD5ac9a8575f3472c2d22cc87780d2bc357
SHA105dcd9aab735449546001e3be1704c1bfb61e712
SHA256d631878c91f06d200742352021792ebc71b4e831b859f77c601e28f7bca7d046
SHA512bdcf2af526c56acef611150685abc872ca13c2d5da1813f6e62dbb678aa4c04cfd4a034cca1ec4989a656b36ae506e143f5846a721501aa7c315ba94e8169c7d
-
Filesize
122KB
MD5ac9a8575f3472c2d22cc87780d2bc357
SHA105dcd9aab735449546001e3be1704c1bfb61e712
SHA256d631878c91f06d200742352021792ebc71b4e831b859f77c601e28f7bca7d046
SHA512bdcf2af526c56acef611150685abc872ca13c2d5da1813f6e62dbb678aa4c04cfd4a034cca1ec4989a656b36ae506e143f5846a721501aa7c315ba94e8169c7d
-
Filesize
122KB
MD5ac9a8575f3472c2d22cc87780d2bc357
SHA105dcd9aab735449546001e3be1704c1bfb61e712
SHA256d631878c91f06d200742352021792ebc71b4e831b859f77c601e28f7bca7d046
SHA512bdcf2af526c56acef611150685abc872ca13c2d5da1813f6e62dbb678aa4c04cfd4a034cca1ec4989a656b36ae506e143f5846a721501aa7c315ba94e8169c7d
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD58d7256cf5cd9f588aef6e4fbd1c87656
SHA174a565c8928f745090cec9860905aaf92c8d224b
SHA256a212e45a6ce6141ebb8b2266558180c71770c06eee00f1b86cdb241dbcc19c7d
SHA512dedef5712cc30fd72b9198dabffd793d8c011e04bcbd22a564e4eb777e2924705f06dac185139d9877c097d69bb795f7f68f39365979df3c1530cbb5baff3cb8
-
Filesize
122KB
MD5d8ad63de4a4fc5ce472674e95742897e
SHA1a133bafc66cc1e0f3ff0c45402825e41e7df5618
SHA256f07fc918772f1326c243c0ae23e2fa309f4dd4aeef8c9e17ed4d54aac6f5ab25
SHA512c802f0c1c2283e97d36a8abb0dd8f72712c5cf8f08c149d4c03a3d6ba52487612c3646bd991a70b64bba386c93454802a9f4d8185566a6f8a88a875ec1897825
-
Filesize
122KB
MD5d8ad63de4a4fc5ce472674e95742897e
SHA1a133bafc66cc1e0f3ff0c45402825e41e7df5618
SHA256f07fc918772f1326c243c0ae23e2fa309f4dd4aeef8c9e17ed4d54aac6f5ab25
SHA512c802f0c1c2283e97d36a8abb0dd8f72712c5cf8f08c149d4c03a3d6ba52487612c3646bd991a70b64bba386c93454802a9f4d8185566a6f8a88a875ec1897825
-
Filesize
122KB
MD5ad5733588b07e6a14d808a9d328da052
SHA144523723f206185c1da1fb14950301a24e463122
SHA256fbbf2715ca1297da20cda1d5af4a521ad67021558bfd044d0e7ebb691737ae12
SHA5126f8b0cea408f465f0f3ffe57c9f374755c0c9407311cb4a3b9db94a11bde463222af3a31d628be479298e92b569d2eb6b1153e5ca1b90c053517417265827a29
-
Filesize
122KB
MD5ad5733588b07e6a14d808a9d328da052
SHA144523723f206185c1da1fb14950301a24e463122
SHA256fbbf2715ca1297da20cda1d5af4a521ad67021558bfd044d0e7ebb691737ae12
SHA5126f8b0cea408f465f0f3ffe57c9f374755c0c9407311cb4a3b9db94a11bde463222af3a31d628be479298e92b569d2eb6b1153e5ca1b90c053517417265827a29
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1
-
Filesize
122KB
MD58ba4586e68459ec6658d555653a0f5b4
SHA1de02938b1d452714107001e34dcb6bb9de29cc1e
SHA256eec408d53cef68111d557e6b321c1c7c9b7e175bf53be427b180e95eb34671e9
SHA5122e42f199c98c459767b63120dd60f68084a659abcb2fa2af5bcbcaa34fa86e7b6efa7a121f836dce506e0b535a4f9685c2a3138c2beafe4d5c4012a74e1fd2f1