Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    158s
  • max time network
    201s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 06:19

General

  • Target

    6e0bd9cd1b9d1cefaa907ea16fb5845637404e254fcfa39eb0dac4fb846f7459.exe

  • Size

    72KB

  • MD5

    3730b23b9a721e58aa0896281adb401a

  • SHA1

    7f98f17427cf6e97c242e9666157d2156a93d4a2

  • SHA256

    6e0bd9cd1b9d1cefaa907ea16fb5845637404e254fcfa39eb0dac4fb846f7459

  • SHA512

    67483b4785ab940a4adfdd96a4b77e2393fc3afea24aa7c68c39ecba6e917be93ac96aece6a114070381f3c055dbc4d16e58ac3338f4bf2d059e300bf6dc35a3

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2n:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrb

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e0bd9cd1b9d1cefaa907ea16fb5845637404e254fcfa39eb0dac4fb846f7459.exe
    "C:\Users\Admin\AppData\Local\Temp\6e0bd9cd1b9d1cefaa907ea16fb5845637404e254fcfa39eb0dac4fb846f7459.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\1664277629\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1664277629\backup.exe C:\Users\Admin\AppData\Local\Temp\1664277629\
      2⤵
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:852
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:224
        • C:\PerfLogs\update.exe
          C:\PerfLogs\update.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1508
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1356
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2188
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3044
          • C:\Program Files\Common Files\System Restore.exe
            "C:\Program Files\Common Files\System Restore.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4780
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3412
            • C:\Program Files\Common Files\microsoft shared\System Restore.exe
              "C:\Program Files\Common Files\microsoft shared\System Restore.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2260
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4564
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:5064
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2916
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:864
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3236
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1064
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1576
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3196
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5040
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2368
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:944
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4580
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1884
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4548
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3420
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3224
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  PID:224
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • System policy modification
                    PID:4212
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • System policy modification
                    PID:2916
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                      PID:2868
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\data.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:2368
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\System Restore.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                      9⤵
                        PID:3756
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                        9⤵
                          PID:816
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                          9⤵
                            PID:4912
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                            9⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:1344
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                            9⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:4784
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                            9⤵
                              PID:2824
                          • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:4456
                          • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:4044
                          • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                            8⤵
                            • System policy modification
                            PID:3416
                          • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                            8⤵
                              PID:1760
                            • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                              8⤵
                              • System policy modification
                              PID:3508
                            • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                              8⤵
                                PID:4860
                              • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                                8⤵
                                • Disables RegEdit via registry modification
                                PID:64
                              • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                PID:444
                              • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                                8⤵
                                  PID:4576
                                • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                                  8⤵
                                    PID:3972
                                  • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                                    8⤵
                                      PID:4392
                                    • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                                      8⤵
                                        PID:2868
                                      • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                                        8⤵
                                          PID:3808
                                        • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                                          8⤵
                                            PID:1072
                                          • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:1320
                                          • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                                            8⤵
                                              PID:4716
                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                            7⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4572
                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1696
                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                              8⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:5044
                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                              8⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4816
                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                              8⤵
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4924
                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                              8⤵
                                              • Executes dropped EXE
                                              PID:2312
                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                              8⤵
                                              • Disables RegEdit via registry modification
                                              PID:3028
                                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                            7⤵
                                            • System policy modification
                                            PID:2184
                                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                              8⤵
                                                PID:1848
                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                  9⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  PID:2676
                                            • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\data.exe
                                              "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\data.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                              7⤵
                                                PID:900
                                              • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:4504
                                              • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                                7⤵
                                                • Disables RegEdit via registry modification
                                                PID:1852
                                              • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                                7⤵
                                                  PID:2316
                                                  • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                    8⤵
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:3596
                                                • C:\Program Files\Common Files\microsoft shared\Triedit\data.exe
                                                  "C:\Program Files\Common Files\microsoft shared\Triedit\data.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                                  7⤵
                                                    PID:4884
                                                    • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                      8⤵
                                                        PID:64
                                                    • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                                      7⤵
                                                      • System policy modification
                                                      PID:2200
                                                    • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                                      7⤵
                                                        PID:3008
                                                      • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                                        7⤵
                                                        • Drops file in Program Files directory
                                                        PID:500
                                                        • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                          8⤵
                                                          • Disables RegEdit via registry modification
                                                          PID:3760
                                                          • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                            9⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            PID:3348
                                                    • C:\Program Files\Common Files\Services\backup.exe
                                                      "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:3340
                                                    • C:\Program Files\Common Files\System\System Restore.exe
                                                      "C:\Program Files\Common Files\System\System Restore.exe" C:\Program Files\Common Files\System\
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1660
                                                      • C:\Program Files\Common Files\System\ado\backup.exe
                                                        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3052
                                                        • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1312
                                                        • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          • System policy modification
                                                          PID:4380
                                                        • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1420
                                                        • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                          8⤵
                                                          • System policy modification
                                                          PID:4900
                                                        • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                          8⤵
                                                            PID:2400
                                                          • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                            "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                            8⤵
                                                              PID:3732
                                                          • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                            "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                            7⤵
                                                            • Disables RegEdit via registry modification
                                                            PID:3096
                                                          • C:\Program Files\Common Files\System\en-US\update.exe
                                                            "C:\Program Files\Common Files\System\en-US\update.exe" C:\Program Files\Common Files\System\en-US\
                                                            7⤵
                                                            • Disables RegEdit via registry modification
                                                            • System policy modification
                                                            PID:3488
                                                          • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                            "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                            7⤵
                                                              PID:3908
                                                            • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                              "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                              7⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:2232
                                                            • C:\Program Files\Common Files\System\it-IT\update.exe
                                                              "C:\Program Files\Common Files\System\it-IT\update.exe" C:\Program Files\Common Files\System\it-IT\
                                                              7⤵
                                                                PID:1668
                                                              • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                7⤵
                                                                  PID:924
                                                                • C:\Program Files\Common Files\System\msadc\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                                  7⤵
                                                                  • Drops file in Program Files directory
                                                                  PID:4744
                                                                  • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                                    "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                    8⤵
                                                                    • Disables RegEdit via registry modification
                                                                    PID:1336
                                                                  • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                    8⤵
                                                                      PID:3988
                                                                    • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                      "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                      8⤵
                                                                        PID:1744
                                                                      • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                        "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                        8⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:732
                                                                      • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                        "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                        8⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:3784
                                                                      • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                        "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                        8⤵
                                                                          PID:3144
                                                                      • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                        "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                        7⤵
                                                                        • Drops file in Program Files directory
                                                                        PID:4000
                                                                        • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                          "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                          8⤵
                                                                            PID:1668
                                                                          • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                            "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                            8⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:4512
                                                                          • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                            "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                            8⤵
                                                                              PID:3900
                                                                            • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                              "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                              8⤵
                                                                                PID:4076
                                                                              • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                                "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                                8⤵
                                                                                • Disables RegEdit via registry modification
                                                                                PID:4476
                                                                              • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                                "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                                8⤵
                                                                                  PID:4752
                                                                          • C:\Program Files\Google\System Restore.exe
                                                                            "C:\Program Files\Google\System Restore.exe" C:\Program Files\Google\
                                                                            5⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1448
                                                                            • C:\Program Files\Google\Chrome\backup.exe
                                                                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2600
                                                                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                                7⤵
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Drops file in Program Files directory
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4392
                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                  8⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Program Files directory
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:732
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                    9⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:3020
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                    9⤵
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4716
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                    9⤵
                                                                                    • System policy modification
                                                                                    PID:3176
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                    9⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:1948
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                    9⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:5040
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                    9⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:3248
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                    9⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:1452
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                    9⤵
                                                                                      PID:3664
                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                        10⤵
                                                                                          PID:1280
                                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                            11⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:4304
                                                                                    • C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                      8⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      • System policy modification
                                                                                      PID:1128
                                                                              • C:\Program Files\Internet Explorer\backup.exe
                                                                                "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Program Files directory
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1444
                                                                                • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4812
                                                                                • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1320
                                                                                • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3472
                                                                                • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                  6⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  PID:2712
                                                                                • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                  6⤵
                                                                                    PID:3044
                                                                                  • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                    "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                    6⤵
                                                                                      PID:4744
                                                                                    • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                      "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                      6⤵
                                                                                        PID:1260
                                                                                      • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                        "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                        6⤵
                                                                                          PID:2928
                                                                                      • C:\Program Files\Java\backup.exe
                                                                                        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                        5⤵
                                                                                          PID:3980
                                                                                          • C:\Program Files\Java\jdk1.8.0_66\data.exe
                                                                                            "C:\Program Files\Java\jdk1.8.0_66\data.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                            6⤵
                                                                                            • Drops file in Program Files directory
                                                                                            PID:2464
                                                                                            • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                              "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                              7⤵
                                                                                                PID:4476
                                                                                              • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                                "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                                7⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:3888
                                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                                  8⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:3160
                                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\lib\System Restore.exe
                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\lib\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                  8⤵
                                                                                                    PID:1508
                                                                                                • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                                  7⤵
                                                                                                    PID:4588
                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                      8⤵
                                                                                                      • Drops file in Program Files directory
                                                                                                      PID:4452
                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\System Restore.exe
                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                        9⤵
                                                                                                          PID:3576
                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                      7⤵
                                                                                                      • System policy modification
                                                                                                      PID:4164
                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                        8⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:4360
                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                          9⤵
                                                                                                            PID:4460
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\System Restore.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                                            9⤵
                                                                                                              PID:2916
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                                              9⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • System policy modification
                                                                                                              PID:5056
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                                            8⤵
                                                                                                            • Drops file in Program Files directory
                                                                                                            • System policy modification
                                                                                                            PID:2204
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\
                                                                                                              9⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:3720
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\
                                                                                                              9⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:4704
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\
                                                                                                              9⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • System policy modification
                                                                                                              PID:3164
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\
                                                                                                              9⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:2352
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\
                                                                                                              9⤵
                                                                                                                PID:4720
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\data.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\data.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\
                                                                                                                9⤵
                                                                                                                  PID:2240
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\
                                                                                                                  9⤵
                                                                                                                    PID:620
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                                                                7⤵
                                                                                                                  PID:4104
                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe
                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\
                                                                                                                    8⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:2976
                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe
                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\
                                                                                                                      9⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      PID:1264
                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\update.exe
                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\update.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
                                                                                                                        10⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        PID:4352
                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\
                                                                                                                        10⤵
                                                                                                                          PID:1016
                                                                                                                • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                                  6⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • System policy modification
                                                                                                                  PID:2340
                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                                    7⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:4656
                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\data.exe
                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\data.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                      8⤵
                                                                                                                        PID:4916
                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\data.exe
                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\data.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                        8⤵
                                                                                                                        • System policy modification
                                                                                                                        PID:4716
                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                        8⤵
                                                                                                                          PID:3460
                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\lib\backup.exe
                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\lib\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\
                                                                                                                        7⤵
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        • System policy modification
                                                                                                                        PID:924
                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\lib\amd64\backup.exe
                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\lib\amd64\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\amd64\
                                                                                                                          8⤵
                                                                                                                            PID:3808
                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe
                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\applet\
                                                                                                                            8⤵
                                                                                                                              PID:1800
                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe
                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\cmm\
                                                                                                                              8⤵
                                                                                                                              • System policy modification
                                                                                                                              PID:3524
                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe
                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\deploy\
                                                                                                                              8⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:980
                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\lib\ext\backup.exe
                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\lib\ext\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\ext\
                                                                                                                              8⤵
                                                                                                                                PID:4584
                                                                                                                              • C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe
                                                                                                                                "C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\fonts\
                                                                                                                                8⤵
                                                                                                                                  PID:3908
                                                                                                                                • C:\Program Files\Java\jre1.8.0_66\lib\images\backup.exe
                                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\lib\images\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\images\
                                                                                                                                  8⤵
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • System policy modification
                                                                                                                                  PID:1964
                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\backup.exe
                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\
                                                                                                                                    9⤵
                                                                                                                                      PID:3160
                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\jfr\backup.exe
                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\jfr\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\jfr\
                                                                                                                                    8⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:2488
                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\management\backup.exe
                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\management\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\management\
                                                                                                                                    8⤵
                                                                                                                                      PID:3052
                                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\lib\security\backup.exe
                                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\lib\security\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\security\
                                                                                                                                      8⤵
                                                                                                                                        PID:4920
                                                                                                                                • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                                  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                                  5⤵
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  PID:2044
                                                                                                                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                                    6⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:1328
                                                                                                                                  • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                                                    "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                                    6⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • System policy modification
                                                                                                                                    PID:380
                                                                                                                                  • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                                                                    "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                                    6⤵
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    • System policy modification
                                                                                                                                    PID:2100
                                                                                                                                    • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                                                                      "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                                                      7⤵
                                                                                                                                        PID:3440
                                                                                                                                      • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                                                        "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                                                        7⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        PID:524
                                                                                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                                          8⤵
                                                                                                                                            PID:3416
                                                                                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                                                                                            "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                                                                                            8⤵
                                                                                                                                              PID:2032
                                                                                                                                            • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
                                                                                                                                              "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
                                                                                                                                              8⤵
                                                                                                                                              • System policy modification
                                                                                                                                              PID:4976
                                                                                                                                          • C:\Program Files\Microsoft Office\root\fre\backup.exe
                                                                                                                                            "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
                                                                                                                                            7⤵
                                                                                                                                              PID:3880
                                                                                                                                            • C:\Program Files\Microsoft Office\root\Integration\backup.exe
                                                                                                                                              "C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\
                                                                                                                                              7⤵
                                                                                                                                                PID:4192
                                                                                                                                                • C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe
                                                                                                                                                  "C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\
                                                                                                                                                  8⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:5052
                                                                                                                                              • C:\Program Files\Microsoft Office\root\Licenses\backup.exe
                                                                                                                                                "C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\
                                                                                                                                                7⤵
                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                PID:1556
                                                                                                                                              • C:\Program Files\Microsoft Office\root\Licenses16\backup.exe
                                                                                                                                                "C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\
                                                                                                                                                7⤵
                                                                                                                                                  PID:3880
                                                                                                                                                • C:\Program Files\Microsoft Office\root\loc\backup.exe
                                                                                                                                                  "C:\Program Files\Microsoft Office\root\loc\backup.exe" C:\Program Files\Microsoft Office\root\loc\
                                                                                                                                                  7⤵
                                                                                                                                                    PID:1416
                                                                                                                                                • C:\Program Files\Microsoft Office\Updates\backup.exe
                                                                                                                                                  "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
                                                                                                                                                  6⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  PID:944
                                                                                                                                                  • C:\Program Files\Microsoft Office\Updates\Apply\backup.exe
                                                                                                                                                    "C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\
                                                                                                                                                    7⤵
                                                                                                                                                      PID:2260
                                                                                                                                                      • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe
                                                                                                                                                        "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\
                                                                                                                                                        8⤵
                                                                                                                                                          PID:2676
                                                                                                                                                  • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                                                                    "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                                                                    5⤵
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    PID:3236
                                                                                                                                                    • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                                                                                                      "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                                                                                      6⤵
                                                                                                                                                        PID:4304
                                                                                                                                                    • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                                                                      "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                                                                      5⤵
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:1260
                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                                                                                                                        "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                                                                                                                        6⤵
                                                                                                                                                          PID:2488
                                                                                                                                                          • C:\Program Files\Mozilla Firefox\browser\features\backup.exe
                                                                                                                                                            "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
                                                                                                                                                            7⤵
                                                                                                                                                              PID:4780
                                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\VisualElements\update.exe
                                                                                                                                                              "C:\Program Files\Mozilla Firefox\browser\VisualElements\update.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
                                                                                                                                                              7⤵
                                                                                                                                                                PID:2860
                                                                                                                                                            • C:\Program Files\Mozilla Firefox\defaults\backup.exe
                                                                                                                                                              "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
                                                                                                                                                              6⤵
                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                              PID:3296
                                                                                                                                                              • C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
                                                                                                                                                                "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
                                                                                                                                                                7⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                PID:3440
                                                                                                                                                            • C:\Program Files\Mozilla Firefox\fonts\backup.exe
                                                                                                                                                              "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
                                                                                                                                                              6⤵
                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:4876
                                                                                                                                                            • C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe
                                                                                                                                                              "C:\Program Files\Mozilla Firefox\gmp-clearkey\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\
                                                                                                                                                              6⤵
                                                                                                                                                                PID:3988
                                                                                                                                                                • C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe
                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\backup.exe" C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\
                                                                                                                                                                  7⤵
                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                  PID:2568
                                                                                                                                                              • C:\Program Files\Mozilla Firefox\uninstall\backup.exe
                                                                                                                                                                "C:\Program Files\Mozilla Firefox\uninstall\backup.exe" C:\Program Files\Mozilla Firefox\uninstall\
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:5072
                                                                                                                                                              • C:\Program Files\MSBuild\backup.exe
                                                                                                                                                                "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
                                                                                                                                                                5⤵
                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                PID:3912
                                                                                                                                                                • C:\Program Files\MSBuild\Microsoft\backup.exe
                                                                                                                                                                  "C:\Program Files\MSBuild\Microsoft\backup.exe" C:\Program Files\MSBuild\Microsoft\
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                  • System policy modification
                                                                                                                                                                  PID:3952
                                                                                                                                                                  • C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
                                                                                                                                                                    "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\
                                                                                                                                                                    7⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    PID:2712
                                                                                                                                                                    • C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\update.exe
                                                                                                                                                                      "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\update.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:1132
                                                                                                                                                              • C:\Program Files (x86)\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                                                                4⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:2064
                                                                                                                                                                • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  • System policy modification
                                                                                                                                                                  PID:2752
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:3916
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:4672
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      • System policy modification
                                                                                                                                                                      PID:3892
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:4616
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                            • System policy modification
                                                                                                                                                                            PID:4056
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:4364
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:2000
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:4416
                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:2032
                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  PID:4992
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                                                                    9⤵
                                                                                                                                                                                      PID:4692
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                    PID:1432
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                                                                      9⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                      PID:3044
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\update.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:2568
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:3632
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                                                          9⤵
                                                                                                                                                                                            PID:728
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                                                                          8⤵
                                                                                                                                                                                            PID:1912
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            PID:2844
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                                                                              9⤵
                                                                                                                                                                                                PID:3008
                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                    PID:1760
                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\System Restore.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                    PID:5084
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                        PID:1912
                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                    PID:2692
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                        PID:3224
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                      PID:3436
                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\System Restore.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                    PID:5060
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\update.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                          PID:3412
                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\data.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:1828
                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:4600
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\System Restore.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\System Restore.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                PID:3664
                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:4192
                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                    PID:1444
                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\System Restore.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                      PID:4928
                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                      PID:4632
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          PID:4284
                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:4804
                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:4460
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\update.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\update.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:1144
                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                        PID:4376
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                      PID:384
                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                              PID:3840
                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                  PID:852
                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                    PID:4712
                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                            PID:2148
                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                              PID:4884
                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:2556
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                    PID:2872
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                    PID:2540
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                      PID:4304
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                          PID:1480
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                            PID:8
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\System Restore.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\System Restore.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          PID:1136
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:1476
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:664
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                              PID:1316
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\System\ado\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                PID:4856
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            PID:740
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Google\CrashReports\System Restore.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Google\CrashReports\System Restore.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:1316
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:3100
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:996
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Update\1.3.36.71\data.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Update\1.3.36.71\data.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                        PID:1324
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                        PID:2412
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                          PID:1888
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                              PID:4860
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                          PID:4540
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\
                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                              PID:1296
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\Offline\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                            PID:3100
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                            PID:2428
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:2436
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:900
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:1936
                                                                                                                                                                                                                                                            • C:\Users\backup.exe
                                                                                                                                                                                                                                                              C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:1676
                                                                                                                                                                                                                                                              • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:4088
                                                                                                                                                                                                                                                                • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                  PID:2656
                                                                                                                                                                                                                                                                • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                  PID:2784
                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                  PID:924
                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                  PID:4204
                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:1480
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                      PID:2240
                                                                                                                                                                                                                                                                    • C:\Users\Admin\OneDrive\System Restore.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\OneDrive\System Restore.exe" C:\Users\Admin\OneDrive\
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:536
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:3228
                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            PID:3456
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                          PID:2364
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                          PID:2764
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                      • C:\Users\Public\update.exe
                                                                                                                                                                                                                                                                        C:\Users\Public\update.exe C:\Users\Public\
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:2344
                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:4840
                                                                                                                                                                                                                                                                            • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:4212
                                                                                                                                                                                                                                                                              • C:\Users\Public\Music\data.exe
                                                                                                                                                                                                                                                                                C:\Users\Public\Music\data.exe C:\Users\Public\Music\
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:3372
                                                                                                                                                                                                                                                                                • C:\Users\Public\Pictures\update.exe
                                                                                                                                                                                                                                                                                  C:\Users\Public\Pictures\update.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                  PID:3756
                                                                                                                                                                                                                                                                                • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                                                                  C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:3720
                                                                                                                                                                                                                                                                              • C:\Windows\backup.exe
                                                                                                                                                                                                                                                                                C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:3124
                                                                                                                                                                                                                                                                                • C:\Windows\addins\System Restore.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\addins\System Restore.exe" C:\Windows\addins\
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                  PID:4272
                                                                                                                                                                                                                                                                                • C:\Windows\appcompat\update.exe
                                                                                                                                                                                                                                                                                  C:\Windows\appcompat\update.exe C:\Windows\appcompat\
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:2584
                                                                                                                                                                                                                                                                                  • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:2184
                                                                                                                                                                                                                                                                                    • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                                                                                                                      C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                      PID:4244
                                                                                                                                                                                                                                                                                  • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:1284
                                                                                                                                                                                                                                                                                    • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                                                                                                      C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                    • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                                                                                                                      C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:5088
                                                                                                                                                                                                                                                                                      • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                                                                                                                                                                        C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:576
                                                                                                                                                                                                                                                                                      • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                                                                                                                                                                        C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:5052
                                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                                                                                                                                                                          C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                            PID:4984
                                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                                                                                                                                                                                          C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                          • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                                                                                                                                                                                            C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:4348
                                                                                                                                                                                                                                                                                            • C:\Windows\apppatch\en-US\backup.exe
                                                                                                                                                                                                                                                                                              C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:3788
                                                                                                                                                                                                                                                                                              • C:\Windows\apppatch\es-ES\backup.exe
                                                                                                                                                                                                                                                                                                C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                                                                                                              • C:\Windows\apppatch\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                                C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:2528
                                                                                                                                                                                                                                                                                                • C:\Windows\apppatch\it-IT\backup.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                  PID:1048
                                                                                                                                                                                                                                                                                                • C:\Windows\apppatch\ja-JP\backup.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                              • C:\Windows\AppReadiness\backup.exe
                                                                                                                                                                                                                                                                                                C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:956
                                                                                                                                                                                                                                                                                                • C:\Windows\assembly\backup.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:2928
                                                                                                                                                                                                                                                                                                  • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:4076
                                                                                                                                                                                                                                                                                                    • C:\Windows\assembly\GAC\ADODB\backup.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:1580
                                                                                                                                                                                                                                                                                                      • C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                          PID:3440
                                                                                                                                                                                                                                                                                                      • C:\Windows\assembly\GAC\Extensibility\backup.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                          PID:3488
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                PID:4800
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                PID:4856
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                PID:4424
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                PID:1348
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                PID:1232
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                PID:4000
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:3420
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                PID:220
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\System Restore.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4816
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\System Restore.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1492
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1444
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                              PID:2548
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:3144

                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                          • C:\PerfLogs\update.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            c43d576a75314b03263ae1686822f5e2

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            74b9d3a8738501ab9684ab5f6756e9d9265076a7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            be6f2a0b7e9898d41216600dc798aa52223d5e4130cce00b27ca699545a2fdd9

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            747ab55ccf15e8260a9702f4912f3f5175e199af0b3c469fc79fe37d5d48b77f596bfe040c7992bd6b6fc9d633bf74a0a469b8a7ad1e3c60170dd99d7e44a5f3

                                                                                                                                                                                                                                                                                                          • C:\PerfLogs\update.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            c43d576a75314b03263ae1686822f5e2

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            74b9d3a8738501ab9684ab5f6756e9d9265076a7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            be6f2a0b7e9898d41216600dc798aa52223d5e4130cce00b27ca699545a2fdd9

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            747ab55ccf15e8260a9702f4912f3f5175e199af0b3c469fc79fe37d5d48b77f596bfe040c7992bd6b6fc9d633bf74a0a469b8a7ad1e3c60170dd99d7e44a5f3

                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            8c9de4c5b8c58dc052c4989c5cc0a3a8

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            eae510a67786505082048e9663877166398d6642

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            8070422caab8c395476cd0a396374d8d4c1f3f3897cc1e6ecf19c505f0ca0d92

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            000ce76f1430172bd0dc8111d40a294b1205cd39d1a53561e7583d5df87f4717f727a99dea52c8a974b0fe0b6bf1b7848c65ea33a7bd4a4633d72c4920ed5aec

                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            8c9de4c5b8c58dc052c4989c5cc0a3a8

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            eae510a67786505082048e9663877166398d6642

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            8070422caab8c395476cd0a396374d8d4c1f3f3897cc1e6ecf19c505f0ca0d92

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            000ce76f1430172bd0dc8111d40a294b1205cd39d1a53561e7583d5df87f4717f727a99dea52c8a974b0fe0b6bf1b7848c65ea33a7bd4a4633d72c4920ed5aec

                                                                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            1e79596dc7da5b218f559e0fed7a161e

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            554b540b31b39c874b801b8fdbaa3ceb44fe4edf

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            1e3cd0d16f86cd35dcf00b8990be613a53ec4dcaadef5527ec6f39c45b6554be

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            1d1acea59a6643f85f347c0b95541fd1960caff1c614f61f7fe4e9b4be03c300a0b17a0465bd3ba41b8e99566e25f0338e27718d9b64478fffb47f493d2d9a23

                                                                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            1e79596dc7da5b218f559e0fed7a161e

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            554b540b31b39c874b801b8fdbaa3ceb44fe4edf

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            1e3cd0d16f86cd35dcf00b8990be613a53ec4dcaadef5527ec6f39c45b6554be

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            1d1acea59a6643f85f347c0b95541fd1960caff1c614f61f7fe4e9b4be03c300a0b17a0465bd3ba41b8e99566e25f0338e27718d9b64478fffb47f493d2d9a23

                                                                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            c32fbe499050191009ce1f2f3cc9f98f

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            47abe211edf0eb7a09d1a0378d595cb75071cd06

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            f982289ff1e1839975dd7b61ef93975189f06b06491f909f9f7470e9187e2900

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e095cbe8f9c2b69744c2aecfa4d87dfc90f57b023fdf8adcbd6feb9a77e2b0fcb82b9717d1fc3709bdf8ac763265cbb869ad075976f66cdb6ae85fdfe4bf8b40

                                                                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            c32fbe499050191009ce1f2f3cc9f98f

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            47abe211edf0eb7a09d1a0378d595cb75071cd06

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            f982289ff1e1839975dd7b61ef93975189f06b06491f909f9f7470e9187e2900

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e095cbe8f9c2b69744c2aecfa4d87dfc90f57b023fdf8adcbd6feb9a77e2b0fcb82b9717d1fc3709bdf8ac763265cbb869ad075976f66cdb6ae85fdfe4bf8b40

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ce610a6ac8ddd8fcb540e3f2ea68e572

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c9d84d4e08453396521553fb0c8828fa1149878c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            728740ddc9d52af3231f578c0dc0a2282bb2bded6c1b67b205d9d45c09983c9c

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8ffbb4b248cd3355059f6fe4df0566988ab395958a6ba3a9576dd03d4acdb6acac4b975e88fee3a8f82327d09b3512aa65bc954b192f7b08a244c7c9a748e421

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ce610a6ac8ddd8fcb540e3f2ea68e572

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c9d84d4e08453396521553fb0c8828fa1149878c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            728740ddc9d52af3231f578c0dc0a2282bb2bded6c1b67b205d9d45c09983c9c

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8ffbb4b248cd3355059f6fe4df0566988ab395958a6ba3a9576dd03d4acdb6acac4b975e88fee3a8f82327d09b3512aa65bc954b192f7b08a244c7c9a748e421

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\Services\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            b71092dfe33f81535d3725643c51f5af

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            5812c069c743abd5c6e411983133483682ad83a2

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c704d792aaf9db4dca1f7a6a1190f5fabfc7b4d29b3429c75411548bbe7a8e20

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            d8f5e8ba776372b50c4df516a9b0eaf5054696a26f9fbb367e080d62fac98911a53140e1d04a6fcc62f189b2831ef119ec58dfcf667f66fca14c63acdaf52aca

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\System Restore.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            bd3f9bd17f03b7c708318168cfde40a5

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c82ba61943ebcea43e1c20360b8d7236ad736718

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            17809eb8b15f155d4940edb9ef1d48fb0b7cd04d4b5e4301597106c3668d9385

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            dc1f9064d01a73a61fc34018901c7b9a79d574e329bcadd9988bc86f34f45df2ac7839b79f9642795b4c990e684371c6438189e5e207eb541276296b2452454d

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\System Restore.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            bd3f9bd17f03b7c708318168cfde40a5

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c82ba61943ebcea43e1c20360b8d7236ad736718

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            17809eb8b15f155d4940edb9ef1d48fb0b7cd04d4b5e4301597106c3668d9385

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            dc1f9064d01a73a61fc34018901c7b9a79d574e329bcadd9988bc86f34f45df2ac7839b79f9642795b4c990e684371c6438189e5e207eb541276296b2452454d

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            436ff3bbe5f10116bf62994a22a3aa15

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            85af0298990673806a0d495d8a9d7af5f953d074

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            953f8825b95b23ebe59a81c10a140f8b7c13b9410b37f7b8563708ec13a09204

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8fc662204da28563e3e3b8399294435f3a936164dd594a5242e1bbe1c848b01b020cac8b9a42264b0a772e837c1b1b117be9310e36955efd50f0148a599a4f38

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            436ff3bbe5f10116bf62994a22a3aa15

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            85af0298990673806a0d495d8a9d7af5f953d074

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            953f8825b95b23ebe59a81c10a140f8b7c13b9410b37f7b8563708ec13a09204

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8fc662204da28563e3e3b8399294435f3a936164dd594a5242e1bbe1c848b01b020cac8b9a42264b0a772e837c1b1b117be9310e36955efd50f0148a599a4f38

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            efa94d196848d6c3abf478393ef06d64

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a4a082ac9c904dfdb77da32ee492a37608dec412

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            44e09da58675f2a60e78d1ea894642acc322c830eba649c0e0cb18d1e694d73d

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fea5d5080e2ef5be8126645e153c277c42be13debf33886e2779e5f5513da0426dbe37f95cca9ce47b8bed4b7573b9908fb3c92730f601dbea66eebeb499b8c6

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\System Restore.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ce610a6ac8ddd8fcb540e3f2ea68e572

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c9d84d4e08453396521553fb0c8828fa1149878c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            728740ddc9d52af3231f578c0dc0a2282bb2bded6c1b67b205d9d45c09983c9c

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8ffbb4b248cd3355059f6fe4df0566988ab395958a6ba3a9576dd03d4acdb6acac4b975e88fee3a8f82327d09b3512aa65bc954b192f7b08a244c7c9a748e421

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\System Restore.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ce610a6ac8ddd8fcb540e3f2ea68e572

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c9d84d4e08453396521553fb0c8828fa1149878c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            728740ddc9d52af3231f578c0dc0a2282bb2bded6c1b67b205d9d45c09983c9c

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8ffbb4b248cd3355059f6fe4df0566988ab395958a6ba3a9576dd03d4acdb6acac4b975e88fee3a8f82327d09b3512aa65bc954b192f7b08a244c7c9a748e421

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9465f1292b31dc7dde0ca5004d1aa307

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c436587247e33a6d89a3d36fbd18e6752208207c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            ab5fa4f717b8419b5b8ef04b19d7225d3f40a51ee8c3f3eb601580205f61a8cc

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fb9d033a22ef7b23325ae5c64efa88fcfd293fff3f8a83415446cd9a5cfa3eb6d2d81d5f1ce82b071823eca70306a8b8b332e683440e159ed810703fed4e4514

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9465f1292b31dc7dde0ca5004d1aa307

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c436587247e33a6d89a3d36fbd18e6752208207c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            ab5fa4f717b8419b5b8ef04b19d7225d3f40a51ee8c3f3eb601580205f61a8cc

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fb9d033a22ef7b23325ae5c64efa88fcfd293fff3f8a83415446cd9a5cfa3eb6d2d81d5f1ce82b071823eca70306a8b8b332e683440e159ed810703fed4e4514

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            436ff3bbe5f10116bf62994a22a3aa15

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            85af0298990673806a0d495d8a9d7af5f953d074

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            953f8825b95b23ebe59a81c10a140f8b7c13b9410b37f7b8563708ec13a09204

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8fc662204da28563e3e3b8399294435f3a936164dd594a5242e1bbe1c848b01b020cac8b9a42264b0a772e837c1b1b117be9310e36955efd50f0148a599a4f38

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            436ff3bbe5f10116bf62994a22a3aa15

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            85af0298990673806a0d495d8a9d7af5f953d074

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            953f8825b95b23ebe59a81c10a140f8b7c13b9410b37f7b8563708ec13a09204

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8fc662204da28563e3e3b8399294435f3a936164dd594a5242e1bbe1c848b01b020cac8b9a42264b0a772e837c1b1b117be9310e36955efd50f0148a599a4f38

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9465f1292b31dc7dde0ca5004d1aa307

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c436587247e33a6d89a3d36fbd18e6752208207c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            ab5fa4f717b8419b5b8ef04b19d7225d3f40a51ee8c3f3eb601580205f61a8cc

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fb9d033a22ef7b23325ae5c64efa88fcfd293fff3f8a83415446cd9a5cfa3eb6d2d81d5f1ce82b071823eca70306a8b8b332e683440e159ed810703fed4e4514

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9465f1292b31dc7dde0ca5004d1aa307

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c436587247e33a6d89a3d36fbd18e6752208207c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            ab5fa4f717b8419b5b8ef04b19d7225d3f40a51ee8c3f3eb601580205f61a8cc

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fb9d033a22ef7b23325ae5c64efa88fcfd293fff3f8a83415446cd9a5cfa3eb6d2d81d5f1ce82b071823eca70306a8b8b332e683440e159ed810703fed4e4514

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9465f1292b31dc7dde0ca5004d1aa307

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c436587247e33a6d89a3d36fbd18e6752208207c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            ab5fa4f717b8419b5b8ef04b19d7225d3f40a51ee8c3f3eb601580205f61a8cc

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fb9d033a22ef7b23325ae5c64efa88fcfd293fff3f8a83415446cd9a5cfa3eb6d2d81d5f1ce82b071823eca70306a8b8b332e683440e159ed810703fed4e4514

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9465f1292b31dc7dde0ca5004d1aa307

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            c436587247e33a6d89a3d36fbd18e6752208207c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            ab5fa4f717b8419b5b8ef04b19d7225d3f40a51ee8c3f3eb601580205f61a8cc

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fb9d033a22ef7b23325ae5c64efa88fcfd293fff3f8a83415446cd9a5cfa3eb6d2d81d5f1ce82b071823eca70306a8b8b332e683440e159ed810703fed4e4514

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            7d889ee08a8276e86bba35aca06b2c28

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            8e0463bcb9f56e7138d64c0bf10024e1483fbb1a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            bea9fa2510475c4e5a7a805bac80f5dedc3ce4e6ec29df8b932d1a0a6f7fabd7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e4e324114e984337059f53bd297f1a20d2afa54abe7ac2a7f12334d01cd070682646dc018ce6c9ee9a691302f90d1dac5e33fe4ca350e8509ed56661e9c717f4

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            7d889ee08a8276e86bba35aca06b2c28

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            8e0463bcb9f56e7138d64c0bf10024e1483fbb1a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            bea9fa2510475c4e5a7a805bac80f5dedc3ce4e6ec29df8b932d1a0a6f7fabd7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e4e324114e984337059f53bd297f1a20d2afa54abe7ac2a7f12334d01cd070682646dc018ce6c9ee9a691302f90d1dac5e33fe4ca350e8509ed56661e9c717f4

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            7d889ee08a8276e86bba35aca06b2c28

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            8e0463bcb9f56e7138d64c0bf10024e1483fbb1a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            bea9fa2510475c4e5a7a805bac80f5dedc3ce4e6ec29df8b932d1a0a6f7fabd7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e4e324114e984337059f53bd297f1a20d2afa54abe7ac2a7f12334d01cd070682646dc018ce6c9ee9a691302f90d1dac5e33fe4ca350e8509ed56661e9c717f4

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            7d889ee08a8276e86bba35aca06b2c28

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            8e0463bcb9f56e7138d64c0bf10024e1483fbb1a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            bea9fa2510475c4e5a7a805bac80f5dedc3ce4e6ec29df8b932d1a0a6f7fabd7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e4e324114e984337059f53bd297f1a20d2afa54abe7ac2a7f12334d01cd070682646dc018ce6c9ee9a691302f90d1dac5e33fe4ca350e8509ed56661e9c717f4

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            7d889ee08a8276e86bba35aca06b2c28

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            8e0463bcb9f56e7138d64c0bf10024e1483fbb1a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            bea9fa2510475c4e5a7a805bac80f5dedc3ce4e6ec29df8b932d1a0a6f7fabd7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e4e324114e984337059f53bd297f1a20d2afa54abe7ac2a7f12334d01cd070682646dc018ce6c9ee9a691302f90d1dac5e33fe4ca350e8509ed56661e9c717f4

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            7d889ee08a8276e86bba35aca06b2c28

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            8e0463bcb9f56e7138d64c0bf10024e1483fbb1a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            bea9fa2510475c4e5a7a805bac80f5dedc3ce4e6ec29df8b932d1a0a6f7fabd7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e4e324114e984337059f53bd297f1a20d2afa54abe7ac2a7f12334d01cd070682646dc018ce6c9ee9a691302f90d1dac5e33fe4ca350e8509ed56661e9c717f4

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9a84af80d7e29e75aae4515dbf4e11fd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e358ac240bb6a9745edb159cb348aa759ff39b75

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b0cbf5eb2a71f6279e9eea0b4d096f17f7ffa09ede0e913e5d213869fe388e7b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            aeb055b16f1075b4a4014519e01a98275d163896f68b673f157cd6186beda2725979f8fc06cdbc3b1d80629ffe4a61ed36b33d38a40c03fdacf565d1a5d7c31e

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9a84af80d7e29e75aae4515dbf4e11fd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e358ac240bb6a9745edb159cb348aa759ff39b75

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b0cbf5eb2a71f6279e9eea0b4d096f17f7ffa09ede0e913e5d213869fe388e7b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            aeb055b16f1075b4a4014519e01a98275d163896f68b673f157cd6186beda2725979f8fc06cdbc3b1d80629ffe4a61ed36b33d38a40c03fdacf565d1a5d7c31e

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9a84af80d7e29e75aae4515dbf4e11fd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e358ac240bb6a9745edb159cb348aa759ff39b75

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b0cbf5eb2a71f6279e9eea0b4d096f17f7ffa09ede0e913e5d213869fe388e7b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            aeb055b16f1075b4a4014519e01a98275d163896f68b673f157cd6186beda2725979f8fc06cdbc3b1d80629ffe4a61ed36b33d38a40c03fdacf565d1a5d7c31e

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9a84af80d7e29e75aae4515dbf4e11fd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e358ac240bb6a9745edb159cb348aa759ff39b75

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b0cbf5eb2a71f6279e9eea0b4d096f17f7ffa09ede0e913e5d213869fe388e7b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            aeb055b16f1075b4a4014519e01a98275d163896f68b673f157cd6186beda2725979f8fc06cdbc3b1d80629ffe4a61ed36b33d38a40c03fdacf565d1a5d7c31e

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9a84af80d7e29e75aae4515dbf4e11fd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e358ac240bb6a9745edb159cb348aa759ff39b75

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b0cbf5eb2a71f6279e9eea0b4d096f17f7ffa09ede0e913e5d213869fe388e7b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            aeb055b16f1075b4a4014519e01a98275d163896f68b673f157cd6186beda2725979f8fc06cdbc3b1d80629ffe4a61ed36b33d38a40c03fdacf565d1a5d7c31e

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9a84af80d7e29e75aae4515dbf4e11fd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e358ac240bb6a9745edb159cb348aa759ff39b75

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b0cbf5eb2a71f6279e9eea0b4d096f17f7ffa09ede0e913e5d213869fe388e7b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            aeb055b16f1075b4a4014519e01a98275d163896f68b673f157cd6186beda2725979f8fc06cdbc3b1d80629ffe4a61ed36b33d38a40c03fdacf565d1a5d7c31e

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9a84af80d7e29e75aae4515dbf4e11fd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e358ac240bb6a9745edb159cb348aa759ff39b75

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b0cbf5eb2a71f6279e9eea0b4d096f17f7ffa09ede0e913e5d213869fe388e7b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            aeb055b16f1075b4a4014519e01a98275d163896f68b673f157cd6186beda2725979f8fc06cdbc3b1d80629ffe4a61ed36b33d38a40c03fdacf565d1a5d7c31e

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9a84af80d7e29e75aae4515dbf4e11fd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            e358ac240bb6a9745edb159cb348aa759ff39b75

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b0cbf5eb2a71f6279e9eea0b4d096f17f7ffa09ede0e913e5d213869fe388e7b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            aeb055b16f1075b4a4014519e01a98275d163896f68b673f157cd6186beda2725979f8fc06cdbc3b1d80629ffe4a61ed36b33d38a40c03fdacf565d1a5d7c31e

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            36ddbd9c3953280b0a49d8a7346eebbe

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            556de1094cdd728f3084a5de3ac62ac6aab52719

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3c1071a02e8354f6f33526b7d943e9ca3630bf6239505215a874fa9f493bb29a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            c03b08046bfc7bdea5c73b43be7214f0994dfdca8c6970a29193f28c3ab7b8907d2da58744961b889b0865b1081464ab39bee60ecfd273c3084d7dd1c291023b

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            36ddbd9c3953280b0a49d8a7346eebbe

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            556de1094cdd728f3084a5de3ac62ac6aab52719

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3c1071a02e8354f6f33526b7d943e9ca3630bf6239505215a874fa9f493bb29a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            c03b08046bfc7bdea5c73b43be7214f0994dfdca8c6970a29193f28c3ab7b8907d2da58744961b889b0865b1081464ab39bee60ecfd273c3084d7dd1c291023b

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\System Restore.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            1d38f1bdbd1819ee36591952fd04bcd0

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            62ce6d71e5ad726f004493df93cfe050b8f40cbd

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c789f209e716542da20d95ebadabf0376c08e24c10816ef270d50c8eb471eb06

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            0bebc5ce2ff3c8d4961afc80e99643545014a8635c92b804fadfe67e015cf9ba67d63231a645396d94e48389efbdac3b77dcda467083baac079f567378382e83

                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\System Restore.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            1d38f1bdbd1819ee36591952fd04bcd0

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            62ce6d71e5ad726f004493df93cfe050b8f40cbd

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c789f209e716542da20d95ebadabf0376c08e24c10816ef270d50c8eb471eb06

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            0bebc5ce2ff3c8d4961afc80e99643545014a8635c92b804fadfe67e015cf9ba67d63231a645396d94e48389efbdac3b77dcda467083baac079f567378382e83

                                                                                                                                                                                                                                                                                                          • C:\Program Files\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            19bc25de09b781b3ca5c946b3f0ef35d

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            5c575b9e8f7b91250675a1ec056c7e17252cca24

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            e3b7a315194da18c1fca042b8cef971ee4a5ebea6af80d44b0a806c15a37004a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            4c9d60a331926883360dcec64a33432ebfb97ec2e4d5f759235b62b1fe53a5ab35498188432bcfbd0ec701962b0c0afad6e2fec01461700fcdb63457b2b3d578

                                                                                                                                                                                                                                                                                                          • C:\Program Files\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            19bc25de09b781b3ca5c946b3f0ef35d

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            5c575b9e8f7b91250675a1ec056c7e17252cca24

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            e3b7a315194da18c1fca042b8cef971ee4a5ebea6af80d44b0a806c15a37004a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            4c9d60a331926883360dcec64a33432ebfb97ec2e4d5f759235b62b1fe53a5ab35498188432bcfbd0ec701962b0c0afad6e2fec01461700fcdb63457b2b3d578

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1664277629\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ea55725e8a60ce6606a09af9b940cba1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            58435fd29aba77b67ba501733fd65da774659a63

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            58e5cf516c68db24d286a083cb7dfb1a541141cb1234cfd6766558857d57f79d

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ad881b085fdab0dfcdeb6ad7a091b3068eec3302c3ae273291f7a162710c49ca047d3ebdc27d27c3377545e4b05200a3eb347d821be6d2282b10e9059b45ba7d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1664277629\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ea55725e8a60ce6606a09af9b940cba1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            58435fd29aba77b67ba501733fd65da774659a63

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            58e5cf516c68db24d286a083cb7dfb1a541141cb1234cfd6766558857d57f79d

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ad881b085fdab0dfcdeb6ad7a091b3068eec3302c3ae273291f7a162710c49ca047d3ebdc27d27c3377545e4b05200a3eb347d821be6d2282b10e9059b45ba7d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9ac5bb28ee44ae33067caaa79a17f515

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            31d8900b52186f2fef8a6d54aa5c7209ba9b1bf0

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            baf5683194c87d13558c658bbf7a1a27edbbfa245cdf6cdf405505b51e0f395e

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            f750df0461d7c79d6d104a33311d229c90037d341273772fb93258b5b647fae3490bb46f818cf1fa93b314e5f45f24d94d261119ac29dd7c016cfc3908de3ec3

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9ac5bb28ee44ae33067caaa79a17f515

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            31d8900b52186f2fef8a6d54aa5c7209ba9b1bf0

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            baf5683194c87d13558c658bbf7a1a27edbbfa245cdf6cdf405505b51e0f395e

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            f750df0461d7c79d6d104a33311d229c90037d341273772fb93258b5b647fae3490bb46f818cf1fa93b314e5f45f24d94d261119ac29dd7c016cfc3908de3ec3

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            e5426e7ac154b116bf213748d28021db

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            201b7b56ade677cb989a7e4fb79cee05d55d81b7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            1132ba64010852bc9addd7f82e74bcf82cad85977d6ca10d84e6937c891808be

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            78735dea5a54b6c561fdfd8cf61c19a3aa1d770ad8eaa9c2a59ab2796962c922a74e392a6d95875d7dd5235316cd2de8a2ab8864f7a858dffd7f6e5f01f18dd2

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            e5426e7ac154b116bf213748d28021db

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            201b7b56ade677cb989a7e4fb79cee05d55d81b7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            1132ba64010852bc9addd7f82e74bcf82cad85977d6ca10d84e6937c891808be

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            78735dea5a54b6c561fdfd8cf61c19a3aa1d770ad8eaa9c2a59ab2796962c922a74e392a6d95875d7dd5235316cd2de8a2ab8864f7a858dffd7f6e5f01f18dd2

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            075f65e3db8a6f4ad02ef808acb05fa4

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            8408d99f150f484a6bd661853ee55f6dbd5027a7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            a0f815a68e4398bd30d2c021e631a98bf1fab6fbc2f229386d4c571230e909dc

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            a54388ff75c539489bb1e37a070a6f2efb8af9d17b565fc2cb96b0ada9f668a1e0c807135dcfc126237838fcbe7f38754ed322edd1bce327a9d43fccec61ae61

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            075f65e3db8a6f4ad02ef808acb05fa4

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            8408d99f150f484a6bd661853ee55f6dbd5027a7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            a0f815a68e4398bd30d2c021e631a98bf1fab6fbc2f229386d4c571230e909dc

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            a54388ff75c539489bb1e37a070a6f2efb8af9d17b565fc2cb96b0ada9f668a1e0c807135dcfc126237838fcbe7f38754ed322edd1bce327a9d43fccec61ae61

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ea55725e8a60ce6606a09af9b940cba1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            58435fd29aba77b67ba501733fd65da774659a63

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            58e5cf516c68db24d286a083cb7dfb1a541141cb1234cfd6766558857d57f79d

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ad881b085fdab0dfcdeb6ad7a091b3068eec3302c3ae273291f7a162710c49ca047d3ebdc27d27c3377545e4b05200a3eb347d821be6d2282b10e9059b45ba7d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ea55725e8a60ce6606a09af9b940cba1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            58435fd29aba77b67ba501733fd65da774659a63

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            58e5cf516c68db24d286a083cb7dfb1a541141cb1234cfd6766558857d57f79d

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ad881b085fdab0dfcdeb6ad7a091b3068eec3302c3ae273291f7a162710c49ca047d3ebdc27d27c3377545e4b05200a3eb347d821be6d2282b10e9059b45ba7d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ea55725e8a60ce6606a09af9b940cba1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            58435fd29aba77b67ba501733fd65da774659a63

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            58e5cf516c68db24d286a083cb7dfb1a541141cb1234cfd6766558857d57f79d

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ad881b085fdab0dfcdeb6ad7a091b3068eec3302c3ae273291f7a162710c49ca047d3ebdc27d27c3377545e4b05200a3eb347d821be6d2282b10e9059b45ba7d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ea55725e8a60ce6606a09af9b940cba1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            58435fd29aba77b67ba501733fd65da774659a63

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            58e5cf516c68db24d286a083cb7dfb1a541141cb1234cfd6766558857d57f79d

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ad881b085fdab0dfcdeb6ad7a091b3068eec3302c3ae273291f7a162710c49ca047d3ebdc27d27c3377545e4b05200a3eb347d821be6d2282b10e9059b45ba7d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            0eee2ec68e6209211405212461c533e1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            082c8eb8a7dd96c7e762bfa9e87229535bf9de02

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            78d660fa85656b5b0f55427d72cb24b6ae4eb54d3146b83a8094443a7cdbeaad

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            b1dd8b2eb6704907be33505ff5e955b8b4e593516e2b66d4ddeea51868d8bdf68548ac135dfdf928a8ddf02ee512ea103660d17f92ec0d9fceef8e05543bea5b

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            0eee2ec68e6209211405212461c533e1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            082c8eb8a7dd96c7e762bfa9e87229535bf9de02

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            78d660fa85656b5b0f55427d72cb24b6ae4eb54d3146b83a8094443a7cdbeaad

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            b1dd8b2eb6704907be33505ff5e955b8b4e593516e2b66d4ddeea51868d8bdf68548ac135dfdf928a8ddf02ee512ea103660d17f92ec0d9fceef8e05543bea5b

                                                                                                                                                                                                                                                                                                          • C:\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            b611f28982aa19807ac9f30b7aeae528

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            ac6e9e25439205ce07533f2ca28c42e87590dfac

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b52d756b5a4776ff86623b88597adaaff6787da9005939740ea8c4d3cc93a9ab

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            180d0880fe109b287c60ac8adbb07700b45411b328fc3af3f4a5244ef0a023f40d06673d436609fcfd75642343afd9a9bf88303655ca6c24052c1a45a8ba572d

                                                                                                                                                                                                                                                                                                          • C:\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            b611f28982aa19807ac9f30b7aeae528

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            ac6e9e25439205ce07533f2ca28c42e87590dfac

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b52d756b5a4776ff86623b88597adaaff6787da9005939740ea8c4d3cc93a9ab

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            180d0880fe109b287c60ac8adbb07700b45411b328fc3af3f4a5244ef0a023f40d06673d436609fcfd75642343afd9a9bf88303655ca6c24052c1a45a8ba572d

                                                                                                                                                                                                                                                                                                          • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            c8a8d25cced9d7dfeae0223f453a4dbb

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            369051dc29546bd9a99f14eaf69a0589753ae01a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            62f72178c1c8fc1cc02c77be000f93fa931b4dd875c66bfe43ca2cf596199fc0

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8f1e28c92fd3e1c99e891a44d8d7cc33bcf31363ea086add10289b3fc9e0b225b986b48c75b5dc9a7eb207387b711fc2b10544a4ac710dff7f6ab5a6ade56cbe

                                                                                                                                                                                                                                                                                                          • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            c8a8d25cced9d7dfeae0223f453a4dbb

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            369051dc29546bd9a99f14eaf69a0589753ae01a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            62f72178c1c8fc1cc02c77be000f93fa931b4dd875c66bfe43ca2cf596199fc0

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8f1e28c92fd3e1c99e891a44d8d7cc33bcf31363ea086add10289b3fc9e0b225b986b48c75b5dc9a7eb207387b711fc2b10544a4ac710dff7f6ab5a6ade56cbe