Overview

overview

10

Static

static

e2b32083ad...1e.exe

windows7-x64

10

e2b32083ad...1e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2022 19:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e2b32083ad3fcb2e4c1db23e84618d4e6da7a9b6eb0870ca912d35ecc4c5461e.exe

  • Size

    72KB

  • MD5

    06c9993cdeff6e112dec30ab78bf4925

  • SHA1

    829e225439bd5c446f30053f2d5b5a34e9b27500

  • SHA256

    e2b32083ad3fcb2e4c1db23e84618d4e6da7a9b6eb0870ca912d35ecc4c5461e

  • SHA512

    224f6bf09dcac5ea342070d2dedcdb7e414f00b5d46ce174d34b5734562a15cf1929f711c735c1b430f1495bcc4c4403b0d63bb81688f89418812bccec1a61f9

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf23:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPD

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2b32083ad3fcb2e4c1db23e84618d4e6da7a9b6eb0870ca912d35ecc4c5461e.exe
    "C:\Users\Admin\AppData\Local\Temp\e2b32083ad3fcb2e4c1db23e84618d4e6da7a9b6eb0870ca912d35ecc4c5461e.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\3472756631\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3472756631\backup.exe C:\Users\Admin\AppData\Local\Temp\3472756631\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:3668
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3816
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2044
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4504
            • C:\Program Files\7-Zip\Lang\data.exe
              "C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2316
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2120
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3756
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4164
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2124
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:876
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:496
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3764
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1904
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1928
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1380
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4344
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4920
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1092
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:852
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4600
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4324
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4252
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1568
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5048
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:648
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:788
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4788
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2672
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4836
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1512
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\update.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3476
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4784
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1708
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4016
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2844
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2764
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3592
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3768
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4880
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2136
                • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1536
                • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4464
                • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3396
                • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1244
                • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:8
                • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2704
                • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3252
                • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1656
                • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3044
                • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1692
                • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4312
                • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2052
                • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4568
                • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2452
                • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2216
                • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  PID:3312
                • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:3756
                • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:2496
                • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\data.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                  8⤵
                    PID:2232
                  • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                    8⤵
                      PID:3692
                    • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\data.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\data.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                      8⤵
                      • System policy modification
                      PID:4900
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                    7⤵
                    • Drops file in Program Files directory
                    • System policy modification
                    PID:1904
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                      8⤵
                        PID:2708
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:552
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • System policy modification
                        PID:4404
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                        8⤵
                          PID:3652
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                          8⤵
                            PID:4400
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                            8⤵
                              PID:1376
                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:4780
                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                              8⤵
                              • System policy modification
                              PID:4708
                          • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:4784
                          • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                            7⤵
                            • System policy modification
                            PID:1888
                          • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                            7⤵
                            • Disables RegEdit via registry modification
                            PID:2216
                          • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:1004
                            • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                              8⤵
                                PID:2988
                            • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                              7⤵
                                PID:848
                                • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                  8⤵
                                  • System policy modification
                                  PID:928
                              • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                PID:1624
                              • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                PID:3896
                              • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                7⤵
                                  PID:2112
                                  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                    8⤵
                                      PID:3836
                                      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\update.exe
                                        "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\update.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                        9⤵
                                        • System policy modification
                                        PID:1560
                                • C:\Program Files\Common Files\Services\backup.exe
                                  "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                  6⤵
                                    PID:2552
                                  • C:\Program Files\Common Files\System\backup.exe
                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                    6⤵
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:1444
                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                      7⤵
                                      • Drops file in Program Files directory
                                      PID:2432
                                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:408
                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:1352
                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                        8⤵
                                          PID:5112
                                        • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                          8⤵
                                            PID:2780
                                          • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                            "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                            8⤵
                                            • Disables RegEdit via registry modification
                                            • System policy modification
                                            PID:3404
                                          • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                            "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            PID:4500
                                        • C:\Program Files\Common Files\System\de-DE\backup.exe
                                          "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                          7⤵
                                            PID:3404
                                          • C:\Program Files\Common Files\System\en-US\backup.exe
                                            "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                            7⤵
                                              PID:4776
                                            • C:\Program Files\Common Files\System\es-ES\data.exe
                                              "C:\Program Files\Common Files\System\es-ES\data.exe" C:\Program Files\Common Files\System\es-ES\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • System policy modification
                                              PID:1152
                                            • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                              "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                              7⤵
                                                PID:5108
                                              • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                7⤵
                                                  PID:4392
                                                • C:\Program Files\Common Files\System\ja-JP\System Restore.exe
                                                  "C:\Program Files\Common Files\System\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ja-JP\
                                                  7⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • System policy modification
                                                  PID:4836
                                                • C:\Program Files\Common Files\System\msadc\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                  7⤵
                                                  • Drops file in Program Files directory
                                                  PID:4000
                                                  • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    PID:4200
                                                  • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                    8⤵
                                                      PID:1856
                                                    • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                      "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                      8⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:5024
                                              • C:\Program Files\Google\backup.exe
                                                "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                5⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:3208
                                                • C:\Program Files\Google\Chrome\backup.exe
                                                  "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                  6⤵
                                                  • Drops file in Program Files directory
                                                  PID:4920
                                                  • C:\Program Files\Google\Chrome\Application\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                    7⤵
                                                      PID:4392
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                        8⤵
                                                        • Drops file in Program Files directory
                                                        • System policy modification
                                                        PID:2036
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                          9⤵
                                                            PID:4188
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\System Restore.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                            9⤵
                                                              PID:928
                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                              9⤵
                                                                PID:2708
                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                9⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:3896
                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\update.exe
                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                9⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:4040
                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                9⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:2364
                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                9⤵
                                                                  PID:4892
                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                  9⤵
                                                                    PID:3560
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                      10⤵
                                                                      • System policy modification
                                                                      PID:4864
                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                        11⤵
                                                                        • System policy modification
                                                                        PID:2496
                                                                • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                  8⤵
                                                                  • System policy modification
                                                                  PID:4136
                                                          • C:\Program Files\Internet Explorer\backup.exe
                                                            "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                            5⤵
                                                            • Drops file in Program Files directory
                                                            PID:4600
                                                            • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                              "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                              6⤵
                                                              • Disables RegEdit via registry modification
                                                              • System policy modification
                                                              PID:4748
                                                            • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                              "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                              6⤵
                                                              • System policy modification
                                                              PID:1900
                                                            • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                              "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                              6⤵
                                                                PID:8
                                                              • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                6⤵
                                                                  PID:4500
                                                                • C:\Program Files\Internet Explorer\images\data.exe
                                                                  "C:\Program Files\Internet Explorer\images\data.exe" C:\Program Files\Internet Explorer\images\
                                                                  6⤵
                                                                    PID:5064
                                                                  • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                    "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                    6⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    PID:4880
                                                                  • C:\Program Files\Internet Explorer\ja-JP\System Restore.exe
                                                                    "C:\Program Files\Internet Explorer\ja-JP\System Restore.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                    6⤵
                                                                      PID:3656
                                                                    • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                      "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                      6⤵
                                                                        PID:3140
                                                                    • C:\Program Files\Java\backup.exe
                                                                      "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                      5⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:1104
                                                                      • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                        "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                        6⤵
                                                                        • Drops file in Program Files directory
                                                                        PID:3756
                                                                        • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                          "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                          7⤵
                                                                            PID:4124
                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                            7⤵
                                                                              PID:332
                                                                              • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                8⤵
                                                                                  PID:1508
                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                  8⤵
                                                                                  • System policy modification
                                                                                  PID:648
                                                                              • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                7⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                • System policy modification
                                                                                PID:5064
                                                                                • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                  8⤵
                                                                                  • Drops file in Program Files directory
                                                                                  PID:4040
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                    9⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:3136
                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                7⤵
                                                                                  PID:928
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                    8⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:4588
                                                                              • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                6⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                • Drops file in Program Files directory
                                                                                • System policy modification
                                                                                PID:232
                                                                                • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                  "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                  7⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  PID:1596
                                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                    8⤵
                                                                                      PID:4152
                                                                                    • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                      "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                      8⤵
                                                                                        PID:4536
                                                                                • C:\Program Files\Microsoft Office\System Restore.exe
                                                                                  "C:\Program Files\Microsoft Office\System Restore.exe" C:\Program Files\Microsoft Office\
                                                                                  5⤵
                                                                                  • Drops file in Program Files directory
                                                                                  PID:5100
                                                                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                    6⤵
                                                                                    • System policy modification
                                                                                    PID:3552
                                                                                  • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                    "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:3844
                                                                                  • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                    "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                    6⤵
                                                                                    • Drops file in Program Files directory
                                                                                    • System policy modification
                                                                                    PID:3680
                                                                                    • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                      "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                      7⤵
                                                                                        PID:1748
                                                                                  • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                    "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                    5⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:5044
                                                                                    • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                                      "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                      6⤵
                                                                                        PID:4204
                                                                                    • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                      "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                      5⤵
                                                                                        PID:988
                                                                                    • C:\Program Files (x86)\backup.exe
                                                                                      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                      4⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Drops file in Program Files directory
                                                                                      PID:2148
                                                                                      • C:\Program Files (x86)\Adobe\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                        5⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        PID:4396
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                          6⤵
                                                                                          • Drops file in Program Files directory
                                                                                          PID:3764
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                            7⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • System policy modification
                                                                                            PID:2608
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                            7⤵
                                                                                            • Drops file in Program Files directory
                                                                                            • System policy modification
                                                                                            PID:4284
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                              8⤵
                                                                                                PID:1592
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                  9⤵
                                                                                                    PID:4552
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                  8⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:2812
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                    9⤵
                                                                                                      PID:784
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\update.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                    8⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    PID:256
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                    8⤵
                                                                                                    • System policy modification
                                                                                                    PID:1940
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                    8⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    PID:5096
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                      9⤵
                                                                                                        PID:1080
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                      8⤵
                                                                                                        PID:4768
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                          9⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          PID:1944
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                        8⤵
                                                                                                          PID:4728
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                          8⤵
                                                                                                            PID:4532
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                              9⤵
                                                                                                              • System policy modification
                                                                                                              PID:4060
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                          7⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Drops file in Program Files directory
                                                                                                          • System policy modification
                                                                                                          PID:1424
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                            8⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:4588
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                              9⤵
                                                                                                                PID:4000
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                              8⤵
                                                                                                                PID:4408
                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                8⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                PID:1148
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\System Restore.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                  9⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:4660
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                    10⤵
                                                                                                                      PID:4536
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                      10⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      PID:4804
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                        11⤵
                                                                                                                          PID:2064
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                          11⤵
                                                                                                                          • System policy modification
                                                                                                                          PID:2848
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\update.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                  7⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:4280
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                    8⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    PID:2856
                                                                                                            • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                              "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                              5⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              • System policy modification
                                                                                                              PID:4516
                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\System Restore.exe
                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                6⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                • System policy modification
                                                                                                                PID:2392
                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                  7⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  • System policy modification
                                                                                                                  PID:1588
                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                  7⤵
                                                                                                                    PID:3624
                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                      8⤵
                                                                                                                        PID:2496
                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                      7⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • System policy modification
                                                                                                                      PID:2936
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                        8⤵
                                                                                                                          PID:4792
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                        7⤵
                                                                                                                          PID:1256
                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                            8⤵
                                                                                                                              PID:5008
                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                9⤵
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                PID:1436
                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                  10⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  PID:4740
                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                  10⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  PID:2944
                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                    11⤵
                                                                                                                                      PID:2592
                                                                                                                          • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                            "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                            6⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            PID:3484
                                                                                                                            • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                              "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                              7⤵
                                                                                                                                PID:3312
                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                              6⤵
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:2948
                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                7⤵
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                PID:4764
                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                7⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                PID:2052
                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                7⤵
                                                                                                                                  PID:4900
                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                    8⤵
                                                                                                                                      PID:1404
                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                      8⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • System policy modification
                                                                                                                                      PID:1408
                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                      8⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      PID:720
                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
                                                                                                                                      8⤵
                                                                                                                                        PID:872
                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\
                                                                                                                                        8⤵
                                                                                                                                          PID:3944
                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\
                                                                                                                                        7⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        PID:4496
                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\
                                                                                                                                          8⤵
                                                                                                                                            PID:4792
                                                                                                                                      • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                        6⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • System policy modification
                                                                                                                                        PID:4788
                                                                                                                                      • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                        6⤵
                                                                                                                                          PID:2204
                                                                                                                                          • C:\Program Files (x86)\Common Files\System\ado\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
                                                                                                                                            7⤵
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            PID:5052
                                                                                                                                            • C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
                                                                                                                                              8⤵
                                                                                                                                                PID:4024
                                                                                                                                              • C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
                                                                                                                                                8⤵
                                                                                                                                                • System policy modification
                                                                                                                                                PID:1160
                                                                                                                                        • C:\Program Files (x86)\Google\update.exe
                                                                                                                                          "C:\Program Files (x86)\Google\update.exe" C:\Program Files (x86)\Google\
                                                                                                                                          5⤵
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:216
                                                                                                                                          • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                            6⤵
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            PID:5008
                                                                                                                                          • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                            6⤵
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            • System policy modification
                                                                                                                                            PID:4444
                                                                                                                                          • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                            6⤵
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            PID:2868
                                                                                                                                          • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                            6⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            PID:3956
                                                                                                                                            • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                              7⤵
                                                                                                                                                PID:3624
                                                                                                                                              • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                7⤵
                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                PID:776
                                                                                                                                                • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                  8⤵
                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                  PID:3436
                                                                                                                                                  • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                                                                                                    9⤵
                                                                                                                                                      PID:2484
                                                                                                                                                • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                                  7⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                  PID:1624
                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                              5⤵
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              PID:952
                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                6⤵
                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                • System policy modification
                                                                                                                                                PID:3488
                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                6⤵
                                                                                                                                                  PID:4812
                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                  6⤵
                                                                                                                                                    PID:3164
                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\fr-FR\data.exe
                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\fr-FR\data.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                    6⤵
                                                                                                                                                      PID:1708
                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\images\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                                                      6⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:3484
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4512
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\data.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\data.exe" C:\Program Files (x86)\Microsoft\Edge\
                                                                                                                                                        6⤵
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:852
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
                                                                                                                                                          7⤵
                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                          PID:3816
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
                                                                                                                                                            8⤵
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            PID:2396
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
                                                                                                                                                              9⤵
                                                                                                                                                                PID:4764
                                                                                                                                                    • C:\Users\backup.exe
                                                                                                                                                      C:\Users\backup.exe C:\Users\
                                                                                                                                                      4⤵
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:2208
                                                                                                                                                      • C:\Users\Admin\backup.exe
                                                                                                                                                        C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                        5⤵
                                                                                                                                                          PID:3736
                                                                                                                                                          • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                            "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                            6⤵
                                                                                                                                                              PID:2672
                                                                                                                                                            • C:\Users\Admin\Contacts\data.exe
                                                                                                                                                              C:\Users\Admin\Contacts\data.exe C:\Users\Admin\Contacts\
                                                                                                                                                              6⤵
                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                              PID:1744
                                                                                                                                                            • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                              C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                              6⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:3728
                                                                                                                                                            • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                              C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                              6⤵
                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:3488
                                                                                                                                                            • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                              C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                              6⤵
                                                                                                                                                                PID:2912
                                                                                                                                                              • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:460
                                                                                                                                                                • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                  C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  PID:1792
                                                                                                                                                                • C:\Users\Admin\Music\System Restore.exe
                                                                                                                                                                  "C:\Users\Admin\Music\System Restore.exe" C:\Users\Admin\Music\
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:1160
                                                                                                                                                                  • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                    C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                    6⤵
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:1940
                                                                                                                                                                  • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                    C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:2024
                                                                                                                                                                      • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                        "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:1820
                                                                                                                                                                        • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                          "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:2084
                                                                                                                                                                      • C:\Users\Public\backup.exe
                                                                                                                                                                        C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                        PID:4620
                                                                                                                                                                        • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                          C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          PID:2492
                                                                                                                                                                        • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                          C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:1092
                                                                                                                                                                          • C:\Users\Public\Music\backup.exe
                                                                                                                                                                            C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:408
                                                                                                                                                                            • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                              C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:3468
                                                                                                                                                                              • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                PID:8
                                                                                                                                                                          • C:\Windows\backup.exe
                                                                                                                                                                            C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:2716
                                                                                                                                                                            • C:\Windows\addins\backup.exe
                                                                                                                                                                              C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:3140
                                                                                                                                                                              • C:\Windows\appcompat\backup.exe
                                                                                                                                                                                C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:2592
                                                                                                                                                                                • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                  C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:4708
                                                                                                                                                                                  • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                    C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    PID:4148
                                                                                                                                                                                • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                  C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:4776
                                                                                                                                                                                  • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                    C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                    PID:1188
                                                                                                                                                                                • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                  C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:3180
                                                                                                                                                                                  • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                                                                    C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                    PID:4716
                                                                                                                                                                                  • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                                                                    C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4448
                                                                                                                                                                                    • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                                                                      C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:1636
                                                                                                                                                                                    • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                                                                                      C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      PID:4280
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:2228
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:4008
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:1244
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:3592
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              • System policy modification
                                                                                                                                                                              PID:220
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:3656

                                                                                                                                                                          Network

                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                          Replay Monitor

                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                          Downloads

                                                                                                                                                                          • C:\PerfLogs\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ded5eda9ddd576d0bd4f00af5f62d504

                                                                                                                                                                            SHA1

                                                                                                                                                                            9c3c80ecd9442a40dd1fa3f2c5426815a9ef0294

                                                                                                                                                                            SHA256

                                                                                                                                                                            c4769555b2c51229a5d1848a0ba9dc3ab9d88d0edb48dc696c097ddb59d2437f

                                                                                                                                                                            SHA512

                                                                                                                                                                            a5113ba806dc81370d47da44b31a0dd79409f1a73d7bc66b119e858c714abdc97ea80971fed0291e2ed2f4177865464096f75b6652bc09f68082c29a3bc0890d

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\PerfLogs\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            ded5eda9ddd576d0bd4f00af5f62d504

                                                                                                                                                                            SHA1

                                                                                                                                                                            9c3c80ecd9442a40dd1fa3f2c5426815a9ef0294

                                                                                                                                                                            SHA256

                                                                                                                                                                            c4769555b2c51229a5d1848a0ba9dc3ab9d88d0edb48dc696c097ddb59d2437f

                                                                                                                                                                            SHA512

                                                                                                                                                                            a5113ba806dc81370d47da44b31a0dd79409f1a73d7bc66b119e858c714abdc97ea80971fed0291e2ed2f4177865464096f75b6652bc09f68082c29a3bc0890d

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\data.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            614df878a649357f6f194c71ed0f8872

                                                                                                                                                                            SHA1

                                                                                                                                                                            7b97d58b8b12dd8f153c58c713bd374a30766047

                                                                                                                                                                            SHA256

                                                                                                                                                                            7cb01097f0183851807e6f6456bda3fdda2e9f41c54556a113060bc9448e3a37

                                                                                                                                                                            SHA512

                                                                                                                                                                            03a8af1803e4f7ded1655dbcdfc90dca1d3c440e2bf1a933ee20b875edf3e18783573f1df7365df207a28dff3b7b03857ee23edfcaeb0eb2b28b4fe8a74cb3cb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\data.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            614df878a649357f6f194c71ed0f8872

                                                                                                                                                                            SHA1

                                                                                                                                                                            7b97d58b8b12dd8f153c58c713bd374a30766047

                                                                                                                                                                            SHA256

                                                                                                                                                                            7cb01097f0183851807e6f6456bda3fdda2e9f41c54556a113060bc9448e3a37

                                                                                                                                                                            SHA512

                                                                                                                                                                            03a8af1803e4f7ded1655dbcdfc90dca1d3c440e2bf1a933ee20b875edf3e18783573f1df7365df207a28dff3b7b03857ee23edfcaeb0eb2b28b4fe8a74cb3cb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7602a02b7cb268616b0ee54feb4c9be5

                                                                                                                                                                            SHA1

                                                                                                                                                                            ca477b860c737ae78f4a47e3b864b5c9b3b7c251

                                                                                                                                                                            SHA256

                                                                                                                                                                            c9d949c2ec5dced561dbba4d7ca9d99654259fae3322fe634964d7d8eec349fc

                                                                                                                                                                            SHA512

                                                                                                                                                                            cb7e3ad1afb30d25665e305697eaeaba69c206c705aea664a68f88eca1f3abedf797a6bf14b09e6a2ee83e3d39f93e3146c4f2e2e32e88fedf9cba62db15fc83

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7602a02b7cb268616b0ee54feb4c9be5

                                                                                                                                                                            SHA1

                                                                                                                                                                            ca477b860c737ae78f4a47e3b864b5c9b3b7c251

                                                                                                                                                                            SHA256

                                                                                                                                                                            c9d949c2ec5dced561dbba4d7ca9d99654259fae3322fe634964d7d8eec349fc

                                                                                                                                                                            SHA512

                                                                                                                                                                            cb7e3ad1afb30d25665e305697eaeaba69c206c705aea664a68f88eca1f3abedf797a6bf14b09e6a2ee83e3d39f93e3146c4f2e2e32e88fedf9cba62db15fc83

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            97fe2bed4a12701eb780988c88291d58

                                                                                                                                                                            SHA1

                                                                                                                                                                            5604ed31f5c20ca64946c1b3c16711b4f27dc850

                                                                                                                                                                            SHA256

                                                                                                                                                                            1a6fd3a5d0a002b6bf47ea652a76e2a6b9c08c5242ad32e998db5e75e4046f79

                                                                                                                                                                            SHA512

                                                                                                                                                                            0ac46dcd843425be34565dcff65ca8c60f596679ac78e696f283ac70183c794996e018f96f426330c052dc8d55a0eb7353180ca9505b1aebb7849fe0f67f2947

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            97fe2bed4a12701eb780988c88291d58

                                                                                                                                                                            SHA1

                                                                                                                                                                            5604ed31f5c20ca64946c1b3c16711b4f27dc850

                                                                                                                                                                            SHA256

                                                                                                                                                                            1a6fd3a5d0a002b6bf47ea652a76e2a6b9c08c5242ad32e998db5e75e4046f79

                                                                                                                                                                            SHA512

                                                                                                                                                                            0ac46dcd843425be34565dcff65ca8c60f596679ac78e696f283ac70183c794996e018f96f426330c052dc8d55a0eb7353180ca9505b1aebb7849fe0f67f2947

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7602a02b7cb268616b0ee54feb4c9be5

                                                                                                                                                                            SHA1

                                                                                                                                                                            ca477b860c737ae78f4a47e3b864b5c9b3b7c251

                                                                                                                                                                            SHA256

                                                                                                                                                                            c9d949c2ec5dced561dbba4d7ca9d99654259fae3322fe634964d7d8eec349fc

                                                                                                                                                                            SHA512

                                                                                                                                                                            cb7e3ad1afb30d25665e305697eaeaba69c206c705aea664a68f88eca1f3abedf797a6bf14b09e6a2ee83e3d39f93e3146c4f2e2e32e88fedf9cba62db15fc83

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7602a02b7cb268616b0ee54feb4c9be5

                                                                                                                                                                            SHA1

                                                                                                                                                                            ca477b860c737ae78f4a47e3b864b5c9b3b7c251

                                                                                                                                                                            SHA256

                                                                                                                                                                            c9d949c2ec5dced561dbba4d7ca9d99654259fae3322fe634964d7d8eec349fc

                                                                                                                                                                            SHA512

                                                                                                                                                                            cb7e3ad1afb30d25665e305697eaeaba69c206c705aea664a68f88eca1f3abedf797a6bf14b09e6a2ee83e3d39f93e3146c4f2e2e32e88fedf9cba62db15fc83

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            eb1ca5f7d1dacb39c9ae205e8addd2d9

                                                                                                                                                                            SHA1

                                                                                                                                                                            95ee412527e72d72fc71fe985f6febb144fdbdd4

                                                                                                                                                                            SHA256

                                                                                                                                                                            92a43fefdf74f4878a26cff632ec3306d852a0c0be2f5b15d672fce9d6d9caa3

                                                                                                                                                                            SHA512

                                                                                                                                                                            cc8951412f633b644631a7dce5f2941aaff2e7f6b95effff3a2122478c3eb1059346bd7483b8c2027aa1e162be3d144abf2b289cf1bec9cfc96123f0db877027

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            eb1ca5f7d1dacb39c9ae205e8addd2d9

                                                                                                                                                                            SHA1

                                                                                                                                                                            95ee412527e72d72fc71fe985f6febb144fdbdd4

                                                                                                                                                                            SHA256

                                                                                                                                                                            92a43fefdf74f4878a26cff632ec3306d852a0c0be2f5b15d672fce9d6d9caa3

                                                                                                                                                                            SHA512

                                                                                                                                                                            cc8951412f633b644631a7dce5f2941aaff2e7f6b95effff3a2122478c3eb1059346bd7483b8c2027aa1e162be3d144abf2b289cf1bec9cfc96123f0db877027

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            1816824e43aff0ca8d48fe3c9deb4754

                                                                                                                                                                            SHA1

                                                                                                                                                                            4d74c0191f2bbd66a7233589e5cc9b651526ff28

                                                                                                                                                                            SHA256

                                                                                                                                                                            53d66e94b046c100f8b314e9827f20c4cd1efcd4ce96d690d5a18fc05a3db03e

                                                                                                                                                                            SHA512

                                                                                                                                                                            c2ab72de07e5b3cc78528e851475eb248c368b3fba4d8d9ec5a82b12a9950079bd736c1736b5f1658c19cb7586be6f5e2ce1eecbd7e5e1582f4e91625dbea488

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            1816824e43aff0ca8d48fe3c9deb4754

                                                                                                                                                                            SHA1

                                                                                                                                                                            4d74c0191f2bbd66a7233589e5cc9b651526ff28

                                                                                                                                                                            SHA256

                                                                                                                                                                            53d66e94b046c100f8b314e9827f20c4cd1efcd4ce96d690d5a18fc05a3db03e

                                                                                                                                                                            SHA512

                                                                                                                                                                            c2ab72de07e5b3cc78528e851475eb248c368b3fba4d8d9ec5a82b12a9950079bd736c1736b5f1658c19cb7586be6f5e2ce1eecbd7e5e1582f4e91625dbea488

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            dfd895567cd46bfdecb406e2f27d18ff

                                                                                                                                                                            SHA1

                                                                                                                                                                            8d972060e3cddfa2b7acd011c9bb73dd8de15d49

                                                                                                                                                                            SHA256

                                                                                                                                                                            83c7f6629abf07043afe6da9901ac3071810b52ad0968ad05b7521c7ecb0d8f6

                                                                                                                                                                            SHA512

                                                                                                                                                                            d51a0c129732eadcfc84e8edd863bf5db3e40ad734a71917b2b485ceceee87fcca2ca5d2bc3fa21b104e5ae29c1bb04ba8540938983dd676ba130b4f8ba63a83

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            dfd895567cd46bfdecb406e2f27d18ff

                                                                                                                                                                            SHA1

                                                                                                                                                                            8d972060e3cddfa2b7acd011c9bb73dd8de15d49

                                                                                                                                                                            SHA256

                                                                                                                                                                            83c7f6629abf07043afe6da9901ac3071810b52ad0968ad05b7521c7ecb0d8f6

                                                                                                                                                                            SHA512

                                                                                                                                                                            d51a0c129732eadcfc84e8edd863bf5db3e40ad734a71917b2b485ceceee87fcca2ca5d2bc3fa21b104e5ae29c1bb04ba8540938983dd676ba130b4f8ba63a83

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            eb1ca5f7d1dacb39c9ae205e8addd2d9

                                                                                                                                                                            SHA1

                                                                                                                                                                            95ee412527e72d72fc71fe985f6febb144fdbdd4

                                                                                                                                                                            SHA256

                                                                                                                                                                            92a43fefdf74f4878a26cff632ec3306d852a0c0be2f5b15d672fce9d6d9caa3

                                                                                                                                                                            SHA512

                                                                                                                                                                            cc8951412f633b644631a7dce5f2941aaff2e7f6b95effff3a2122478c3eb1059346bd7483b8c2027aa1e162be3d144abf2b289cf1bec9cfc96123f0db877027

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            eb1ca5f7d1dacb39c9ae205e8addd2d9

                                                                                                                                                                            SHA1

                                                                                                                                                                            95ee412527e72d72fc71fe985f6febb144fdbdd4

                                                                                                                                                                            SHA256

                                                                                                                                                                            92a43fefdf74f4878a26cff632ec3306d852a0c0be2f5b15d672fce9d6d9caa3

                                                                                                                                                                            SHA512

                                                                                                                                                                            cc8951412f633b644631a7dce5f2941aaff2e7f6b95effff3a2122478c3eb1059346bd7483b8c2027aa1e162be3d144abf2b289cf1bec9cfc96123f0db877027

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e8f1370c466c7165557c20209553219e

                                                                                                                                                                            SHA1

                                                                                                                                                                            bef64bab63065f12c3e5b66b51b793ae5fb1688c

                                                                                                                                                                            SHA256

                                                                                                                                                                            4417c9a88005610daa45cbce2ef7cfee08e43a5038b58d01e0a3b1ea394293d3

                                                                                                                                                                            SHA512

                                                                                                                                                                            1894eb6fb853e9cb36b96d4ec412aa7e1cc940be7f16cfab5542031b4ce0e9088f5fe46109d6d65f2470a4be7ee92ed048b158992c49ff588f5b5b940b4aacfb

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            b4591052b22be54b972dc508db41fccf

                                                                                                                                                                            SHA1

                                                                                                                                                                            7cadd8f7a7b494525ec884e2bf90fca34395ca19

                                                                                                                                                                            SHA256

                                                                                                                                                                            a7b55d598939962aa48c49664b84a11be6b61063d510730ed8fd2bd3ab087b64

                                                                                                                                                                            SHA512

                                                                                                                                                                            2169b5158836801735d200ef08a76fe71ac9690aca0b609a156e2b3634aa32ce3c2a24c102b111b1ee3b8de25589f7af671c619195da496a5d85eda2592f3bd4

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            04ccffab52630c22dc8e83defddb8f40

                                                                                                                                                                            SHA1

                                                                                                                                                                            59b9c210021aad609e13a31f62622480f069c1b2

                                                                                                                                                                            SHA256

                                                                                                                                                                            9703450e159f932dfb13f937427144e33406abc8cff3e4f78958181ffdf5d179

                                                                                                                                                                            SHA512

                                                                                                                                                                            7dd86ad10058668274167ccf9ab6d74c7bcd98f38511cfeb49da9773459d71cf9acedfc7c7984af93fe0f62c75a23e5ad1a453cd681588e44e871bcb7d7a6780

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Program Files\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            04ccffab52630c22dc8e83defddb8f40

                                                                                                                                                                            SHA1

                                                                                                                                                                            59b9c210021aad609e13a31f62622480f069c1b2

                                                                                                                                                                            SHA256

                                                                                                                                                                            9703450e159f932dfb13f937427144e33406abc8cff3e4f78958181ffdf5d179

                                                                                                                                                                            SHA512

                                                                                                                                                                            7dd86ad10058668274167ccf9ab6d74c7bcd98f38511cfeb49da9773459d71cf9acedfc7c7984af93fe0f62c75a23e5ad1a453cd681588e44e871bcb7d7a6780

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3472756631\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            993eabbb597dd02cee232cfdf332d218

                                                                                                                                                                            SHA1

                                                                                                                                                                            05f1f8d259cb0c45bdf7fb400260167d992db7dc

                                                                                                                                                                            SHA256

                                                                                                                                                                            5ce9819c489c404155eb610947eeb804da0feeee49f2f637797a457762e1ae8b

                                                                                                                                                                            SHA512

                                                                                                                                                                            1f3d7068c7b5dfc12626d1621e103287f23527d3b6cc14c411fac222f8598d3763fb94abbf4af6bb1be46fdf426a03013d24d56b87152cb9eed9cf6938dcc3f6

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3472756631\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            993eabbb597dd02cee232cfdf332d218

                                                                                                                                                                            SHA1

                                                                                                                                                                            05f1f8d259cb0c45bdf7fb400260167d992db7dc

                                                                                                                                                                            SHA256

                                                                                                                                                                            5ce9819c489c404155eb610947eeb804da0feeee49f2f637797a457762e1ae8b

                                                                                                                                                                            SHA512

                                                                                                                                                                            1f3d7068c7b5dfc12626d1621e103287f23527d3b6cc14c411fac222f8598d3763fb94abbf4af6bb1be46fdf426a03013d24d56b87152cb9eed9cf6938dcc3f6

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            343d2d5cb9ab3bbc009619ba3a94f5d4

                                                                                                                                                                            SHA1

                                                                                                                                                                            26c6125a88cc08b875c81c9a5b606f4871c83806

                                                                                                                                                                            SHA256

                                                                                                                                                                            ac002cb111653c752d705caf97ff3c3cd9b11f1c85eb48e916a055a2e5a1188a

                                                                                                                                                                            SHA512

                                                                                                                                                                            8c3bc96641add1df8293d59d274308ebb6aa03617923c251137f9e84629560edd3d58770ed8f2970b7fda84d39d4ae5298028921c74c029c9e4f049dee0288a5

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            343d2d5cb9ab3bbc009619ba3a94f5d4

                                                                                                                                                                            SHA1

                                                                                                                                                                            26c6125a88cc08b875c81c9a5b606f4871c83806

                                                                                                                                                                            SHA256

                                                                                                                                                                            ac002cb111653c752d705caf97ff3c3cd9b11f1c85eb48e916a055a2e5a1188a

                                                                                                                                                                            SHA512

                                                                                                                                                                            8c3bc96641add1df8293d59d274308ebb6aa03617923c251137f9e84629560edd3d58770ed8f2970b7fda84d39d4ae5298028921c74c029c9e4f049dee0288a5

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            343d2d5cb9ab3bbc009619ba3a94f5d4

                                                                                                                                                                            SHA1

                                                                                                                                                                            26c6125a88cc08b875c81c9a5b606f4871c83806

                                                                                                                                                                            SHA256

                                                                                                                                                                            ac002cb111653c752d705caf97ff3c3cd9b11f1c85eb48e916a055a2e5a1188a

                                                                                                                                                                            SHA512

                                                                                                                                                                            8c3bc96641add1df8293d59d274308ebb6aa03617923c251137f9e84629560edd3d58770ed8f2970b7fda84d39d4ae5298028921c74c029c9e4f049dee0288a5

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            343d2d5cb9ab3bbc009619ba3a94f5d4

                                                                                                                                                                            SHA1

                                                                                                                                                                            26c6125a88cc08b875c81c9a5b606f4871c83806

                                                                                                                                                                            SHA256

                                                                                                                                                                            ac002cb111653c752d705caf97ff3c3cd9b11f1c85eb48e916a055a2e5a1188a

                                                                                                                                                                            SHA512

                                                                                                                                                                            8c3bc96641add1df8293d59d274308ebb6aa03617923c251137f9e84629560edd3d58770ed8f2970b7fda84d39d4ae5298028921c74c029c9e4f049dee0288a5

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            343d2d5cb9ab3bbc009619ba3a94f5d4

                                                                                                                                                                            SHA1

                                                                                                                                                                            26c6125a88cc08b875c81c9a5b606f4871c83806

                                                                                                                                                                            SHA256

                                                                                                                                                                            ac002cb111653c752d705caf97ff3c3cd9b11f1c85eb48e916a055a2e5a1188a

                                                                                                                                                                            SHA512

                                                                                                                                                                            8c3bc96641add1df8293d59d274308ebb6aa03617923c251137f9e84629560edd3d58770ed8f2970b7fda84d39d4ae5298028921c74c029c9e4f049dee0288a5

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            343d2d5cb9ab3bbc009619ba3a94f5d4

                                                                                                                                                                            SHA1

                                                                                                                                                                            26c6125a88cc08b875c81c9a5b606f4871c83806

                                                                                                                                                                            SHA256

                                                                                                                                                                            ac002cb111653c752d705caf97ff3c3cd9b11f1c85eb48e916a055a2e5a1188a

                                                                                                                                                                            SHA512

                                                                                                                                                                            8c3bc96641add1df8293d59d274308ebb6aa03617923c251137f9e84629560edd3d58770ed8f2970b7fda84d39d4ae5298028921c74c029c9e4f049dee0288a5

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            993eabbb597dd02cee232cfdf332d218

                                                                                                                                                                            SHA1

                                                                                                                                                                            05f1f8d259cb0c45bdf7fb400260167d992db7dc

                                                                                                                                                                            SHA256

                                                                                                                                                                            5ce9819c489c404155eb610947eeb804da0feeee49f2f637797a457762e1ae8b

                                                                                                                                                                            SHA512

                                                                                                                                                                            1f3d7068c7b5dfc12626d1621e103287f23527d3b6cc14c411fac222f8598d3763fb94abbf4af6bb1be46fdf426a03013d24d56b87152cb9eed9cf6938dcc3f6

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            993eabbb597dd02cee232cfdf332d218

                                                                                                                                                                            SHA1

                                                                                                                                                                            05f1f8d259cb0c45bdf7fb400260167d992db7dc

                                                                                                                                                                            SHA256

                                                                                                                                                                            5ce9819c489c404155eb610947eeb804da0feeee49f2f637797a457762e1ae8b

                                                                                                                                                                            SHA512

                                                                                                                                                                            1f3d7068c7b5dfc12626d1621e103287f23527d3b6cc14c411fac222f8598d3763fb94abbf4af6bb1be46fdf426a03013d24d56b87152cb9eed9cf6938dcc3f6

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            993eabbb597dd02cee232cfdf332d218

                                                                                                                                                                            SHA1

                                                                                                                                                                            05f1f8d259cb0c45bdf7fb400260167d992db7dc

                                                                                                                                                                            SHA256

                                                                                                                                                                            5ce9819c489c404155eb610947eeb804da0feeee49f2f637797a457762e1ae8b

                                                                                                                                                                            SHA512

                                                                                                                                                                            1f3d7068c7b5dfc12626d1621e103287f23527d3b6cc14c411fac222f8598d3763fb94abbf4af6bb1be46fdf426a03013d24d56b87152cb9eed9cf6938dcc3f6

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            993eabbb597dd02cee232cfdf332d218

                                                                                                                                                                            SHA1

                                                                                                                                                                            05f1f8d259cb0c45bdf7fb400260167d992db7dc

                                                                                                                                                                            SHA256

                                                                                                                                                                            5ce9819c489c404155eb610947eeb804da0feeee49f2f637797a457762e1ae8b

                                                                                                                                                                            SHA512

                                                                                                                                                                            1f3d7068c7b5dfc12626d1621e103287f23527d3b6cc14c411fac222f8598d3763fb94abbf4af6bb1be46fdf426a03013d24d56b87152cb9eed9cf6938dcc3f6

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            58fab4253fea94c3fef6978b1a59b6e4

                                                                                                                                                                            SHA1

                                                                                                                                                                            97ac4eb5a743e1b0eff49491de3a237773a05b9f

                                                                                                                                                                            SHA256

                                                                                                                                                                            9faba528381f1aac545e5ac0121f61d7d1e25f60994279598b6ebe0207df8d11

                                                                                                                                                                            SHA512

                                                                                                                                                                            640ffb28222aae4f49a76ffb634f65c14bbf734a7280a525bbe4717bbdcf608913fb5990bd929c8a18dd0b28519a4090f443e9078e2e10188d64b2c9f2f39257

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            58fab4253fea94c3fef6978b1a59b6e4

                                                                                                                                                                            SHA1

                                                                                                                                                                            97ac4eb5a743e1b0eff49491de3a237773a05b9f

                                                                                                                                                                            SHA256

                                                                                                                                                                            9faba528381f1aac545e5ac0121f61d7d1e25f60994279598b6ebe0207df8d11

                                                                                                                                                                            SHA512

                                                                                                                                                                            640ffb28222aae4f49a76ffb634f65c14bbf734a7280a525bbe4717bbdcf608913fb5990bd929c8a18dd0b28519a4090f443e9078e2e10188d64b2c9f2f39257

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e5aff5b9a8c5330a737b9087848a2599

                                                                                                                                                                            SHA1

                                                                                                                                                                            db19d35421aff3212d20eeed54260a38d2d657fc

                                                                                                                                                                            SHA256

                                                                                                                                                                            fd207a58d2d666dcb086bdab9c49d92bafaf59f0afa5e329b28bd14b50475e24

                                                                                                                                                                            SHA512

                                                                                                                                                                            e7a7febe25cb6ac4bff90e9f2b3a7fb28726373c35876c5094ff53ebf6895bbefd9004efa95a2dc2cc141d40107bd8fead66d574df02099836e58aabace6e5c2

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            e5aff5b9a8c5330a737b9087848a2599

                                                                                                                                                                            SHA1

                                                                                                                                                                            db19d35421aff3212d20eeed54260a38d2d657fc

                                                                                                                                                                            SHA256

                                                                                                                                                                            fd207a58d2d666dcb086bdab9c49d92bafaf59f0afa5e329b28bd14b50475e24

                                                                                                                                                                            SHA512

                                                                                                                                                                            e7a7febe25cb6ac4bff90e9f2b3a7fb28726373c35876c5094ff53ebf6895bbefd9004efa95a2dc2cc141d40107bd8fead66d574df02099836e58aabace6e5c2

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\odt\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            19a8ba211204da424a1995841f1745b3

                                                                                                                                                                            SHA1

                                                                                                                                                                            c68cacf2f4865e64f9d980846338528d58915ca9

                                                                                                                                                                            SHA256

                                                                                                                                                                            d26340c8aeb04eb71dcc56801c38aabd6143b84006494ae63b293f2e397dd126

                                                                                                                                                                            SHA512

                                                                                                                                                                            b020560cf57a84cdadf61f8c643d64e09ac88bb98ca1d3b8924831dc7cfbdd071da424ef583df7b360518f2b3a4f24d271c22a214eb314696e8c2fe36cb57dc2

                                                                                                                                                                            Download Submit

                                                                                                                                                                          • C:\odt\backup.exe
                                                                                                                                                                            Filesize

                                                                                                                                                                            72KB

                                                                                                                                                                            MD5

                                                                                                                                                                            19a8ba211204da424a1995841f1745b3

                                                                                                                                                                            SHA1

                                                                                                                                                                            c68cacf2f4865e64f9d980846338528d58915ca9

                                                                                                                                                                            SHA256

                                                                                                                                                                            d26340c8aeb04eb71dcc56801c38aabd6143b84006494ae63b293f2e397dd126

                                                                                                                                                                            SHA512

                                                                                                                                                                            b020560cf57a84cdadf61f8c643d64e09ac88bb98ca1d3b8924831dc7cfbdd071da424ef583df7b360518f2b3a4f24d271c22a214eb314696e8c2fe36cb57dc2

                                                                                                                                                                            Download Submit