Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    190s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 06:18

General

  • Target

    75948124e4f770eea11f6f18ccff61615b757e7872950ada5395636c30f1308e.exe

  • Size

    72KB

  • MD5

    55fba1d34931fd5732ae02443bb6d727

  • SHA1

    34ceacbdda3aad385a97683a7e8ff7c1ceedc4d8

  • SHA256

    75948124e4f770eea11f6f18ccff61615b757e7872950ada5395636c30f1308e

  • SHA512

    95005e20d0ca42dca143640ad12ca575bf58bbc4a924320794eade175d78c5b09e8852ebf6da9b6448c6408d314e5f5eab78ba41db1db0a522a875e772a98e52

  • SSDEEP

    384:76wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2r:7pQNwC3BEddsEqOt/hyJF+x3BEJwRrX

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75948124e4f770eea11f6f18ccff61615b757e7872950ada5395636c30f1308e.exe
    "C:\Users\Admin\AppData\Local\Temp\75948124e4f770eea11f6f18ccff61615b757e7872950ada5395636c30f1308e.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Users\Admin\AppData\Local\Temp\183495482\backup.exe
      C:\Users\Admin\AppData\Local\Temp\183495482\backup.exe C:\Users\Admin\AppData\Local\Temp\183495482\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4452
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:352
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4240
        • C:\PerfLogs\System Restore.exe
          "C:\PerfLogs\System Restore.exe" C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3200
        • C:\Program Files\update.exe
          "C:\Program Files\update.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1472
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4944
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4020
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3760
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3296
              • C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe
                "C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\
                7⤵
                  PID:2512
              • C:\Program Files\Common Files\microsoft shared\backup.exe
                "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
                6⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1816
                • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4068
                • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2976
                  • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4616
                  • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3804
                  • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                    8⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4780
                  • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2264
                  • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3536
                  • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                    8⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:936
                  • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2880
                  • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4188
                  • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4872
                  • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3468
                  • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1924
                  • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:292
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:704
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1896
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    PID:4516
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5000
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4212
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1536
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:1108
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3064
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:3820
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                      9⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1968
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4232
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2100
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3148
                  • C:\Program Files\Common Files\microsoft shared\ink\he-IL\update.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\he-IL\update.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3476
                  • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                    8⤵
                      PID:1984
                    • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:3508
                    • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:1456
                    • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                      8⤵
                        PID:4040
                      • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                        8⤵
                          PID:3432
                        • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:5060
                        • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\update.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\update.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                          8⤵
                            PID:8
                          • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                            8⤵
                              PID:3380
                            • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                              8⤵
                              • Disables RegEdit via registry modification
                              PID:4696
                            • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                              8⤵
                              • System policy modification
                              PID:1804
                            • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\update.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\update.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                              8⤵
                              • Disables RegEdit via registry modification
                              PID:2368
                            • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                              8⤵
                                PID:3104
                              • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                                8⤵
                                  PID:1476
                                • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:4112
                                • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\System Restore.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                                  8⤵
                                    PID:3844
                                  • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                                    8⤵
                                      PID:3436
                                    • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                                      8⤵
                                        PID:3876
                                      • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                                        8⤵
                                        • System policy modification
                                        PID:5060
                                        • C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
                                          "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
                                          9⤵
                                            PID:3640
                                          • C:\Program Files\Mozilla Firefox\browser\features\backup.exe
                                            "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
                                            9⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:3736
                                        • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          PID:3844
                                        • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                                          8⤵
                                            PID:3976
                                          • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                                            8⤵
                                              PID:3904
                                            • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                                              8⤵
                                                PID:3984
                                              • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\System Restore.exe
                                                "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                                                8⤵
                                                  PID:3116
                                                • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                                                  8⤵
                                                    PID:660
                                                  • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                                                    8⤵
                                                    • System policy modification
                                                    PID:4692
                                                • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4836
                                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3020
                                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4952
                                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                                    8⤵
                                                    • System policy modification
                                                    PID:4288
                                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                                    8⤵
                                                      PID:1236
                                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                                      8⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      PID:3340
                                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                                      8⤵
                                                        PID:3416
                                                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                                      7⤵
                                                      • System policy modification
                                                      PID:2068
                                                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                                        8⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • System policy modification
                                                        PID:4792
                                                    • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                                      7⤵
                                                        PID:2788
                                                      • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                                        7⤵
                                                          PID:912
                                                        • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                                          7⤵
                                                            PID:2592
                                                          • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                                            7⤵
                                                            • Drops file in Program Files directory
                                                            • System policy modification
                                                            PID:4072
                                                            • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              • System policy modification
                                                              PID:3760
                                                          • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Drops file in Program Files directory
                                                            PID:2396
                                                            • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System policy modification
                                                              PID:4932
                                                          • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                                            7⤵
                                                            • Disables RegEdit via registry modification
                                                            PID:3156
                                                          • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            PID:1652
                                                          • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                                            7⤵
                                                              PID:3620
                                                              • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                                "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                                8⤵
                                                                  PID:2248
                                                                  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                                    "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                                    9⤵
                                                                      PID:2220
                                                              • C:\Program Files\Common Files\Services\backup.exe
                                                                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:912
                                                              • C:\Program Files\Common Files\System\backup.exe
                                                                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:4608
                                                                • C:\Program Files\Common Files\System\ado\backup.exe
                                                                  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                                  7⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4456
                                                                  • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                                    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                                    8⤵
                                                                      PID:4472
                                                                    • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                                      "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                                      8⤵
                                                                        PID:1452
                                                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                                        8⤵
                                                                          PID:4144
                                                                        • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                                          "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                                          8⤵
                                                                            PID:3076
                                                                          • C:\Program Files\Common Files\System\ado\it-IT\data.exe
                                                                            "C:\Program Files\Common Files\System\ado\it-IT\data.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:3064
                                                                          • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                                            "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            PID:1172
                                                                        • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                                          "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                                          7⤵
                                                                            PID:4920
                                                                          • C:\Program Files\Common Files\System\en-US\backup.exe
                                                                            "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                                            7⤵
                                                                              PID:1896
                                                                            • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                                              "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                                              7⤵
                                                                              • System policy modification
                                                                              PID:3096
                                                                            • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                                              "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                              7⤵
                                                                                PID:1360
                                                                              • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                                "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                                7⤵
                                                                                  PID:1228
                                                                                • C:\Program Files\Common Files\System\msadc\backup.exe
                                                                                  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                                                  7⤵
                                                                                  • Drops file in Program Files directory
                                                                                  PID:2524
                                                                                  • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                                                    "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                                    8⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:3352
                                                                                  • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                                    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                                    8⤵
                                                                                      PID:4980
                                                                                    • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                                      "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                                      8⤵
                                                                                        PID:1584
                                                                                      • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                                        "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                                        8⤵
                                                                                          PID:1768
                                                                                        • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                                          "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                                          8⤵
                                                                                            PID:1520
                                                                                          • C:\Program Files\Common Files\System\msadc\ja-JP\update.exe
                                                                                            "C:\Program Files\Common Files\System\msadc\ja-JP\update.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                                            8⤵
                                                                                              PID:2208
                                                                                          • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                                            "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                                            7⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:3412
                                                                                          • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                                            "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                                            7⤵
                                                                                            • Drops file in Program Files directory
                                                                                            PID:2580
                                                                                            • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                                              "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              PID:1148
                                                                                            • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                                              "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                                              8⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:3612
                                                                                            • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                                              "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              PID:712
                                                                                            • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                                              "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                                              8⤵
                                                                                                PID:4748
                                                                                              • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                                                "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                                                8⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:2288
                                                                                              • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                                                "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                                                8⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:4648
                                                                                        • C:\Program Files\Google\backup.exe
                                                                                          "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Program Files directory
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5112
                                                                                          • C:\Program Files\Google\Chrome\backup.exe
                                                                                            "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3872
                                                                                            • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2136
                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:804
                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                                  9⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:840
                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                                  9⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:3344
                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                                  9⤵
                                                                                                    PID:1756
                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                                    9⤵
                                                                                                      PID:3804
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                                      9⤵
                                                                                                      • System policy modification
                                                                                                      PID:2584
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                                      9⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:2764
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                                      9⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:3636
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\System Restore.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                                      9⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Drops file in Program Files directory
                                                                                                      PID:1860
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                                        10⤵
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        • System policy modification
                                                                                                        PID:4760
                                                                                                  • C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                                    8⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:516
                                                                                            • C:\Program Files\Internet Explorer\backup.exe
                                                                                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                              5⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Drops file in Program Files directory
                                                                                              PID:1788
                                                                                              • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                                "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                                6⤵
                                                                                                  PID:1148
                                                                                                • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                                  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                                  6⤵
                                                                                                    PID:4536
                                                                                                  • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                                    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                                    6⤵
                                                                                                      PID:1584
                                                                                                    • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                                      "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                                      6⤵
                                                                                                        PID:4468
                                                                                                      • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                                        "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                                        6⤵
                                                                                                          PID:1924
                                                                                                        • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                                          "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                                          6⤵
                                                                                                            PID:3792
                                                                                                          • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                                            "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                                            6⤵
                                                                                                              PID:876
                                                                                                            • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                                              "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                                              6⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              PID:4216
                                                                                                          • C:\Program Files\Java\data.exe
                                                                                                            "C:\Program Files\Java\data.exe" C:\Program Files\Java\
                                                                                                            5⤵
                                                                                                              PID:884
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                                                6⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                • System policy modification
                                                                                                                PID:1396
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                                                  7⤵
                                                                                                                  • System policy modification
                                                                                                                  PID:1640
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\update.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\update.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                                                  7⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:4920
                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\bin\System Restore.exe
                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\bin\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                                                    8⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    PID:2944
                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                                    8⤵
                                                                                                                    • System policy modification
                                                                                                                    PID:4516
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                                                  7⤵
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  PID:3500
                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                                    8⤵
                                                                                                                      PID:4040
                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                                        9⤵
                                                                                                                        • System policy modification
                                                                                                                        PID:3616
                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                                    7⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • System policy modification
                                                                                                                    PID:4060
                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                                      8⤵
                                                                                                                        PID:1468
                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                                                          9⤵
                                                                                                                            PID:3376
                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                                                          8⤵
                                                                                                                            PID:4600
                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\update.exe
                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\update.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                                        6⤵
                                                                                                                        • System policy modification
                                                                                                                        PID:960
                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\bin\System Restore.exe
                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\bin\System Restore.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                                          7⤵
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          PID:4232
                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                            8⤵
                                                                                                                              PID:4648
                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                              8⤵
                                                                                                                                PID:4308
                                                                                                                              • C:\Program Files\Java\jre1.8.0_66\bin\server\update.exe
                                                                                                                                "C:\Program Files\Java\jre1.8.0_66\bin\server\update.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                                8⤵
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                • System policy modification
                                                                                                                                PID:4368
                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\lib\backup.exe
                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\lib\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\
                                                                                                                              7⤵
                                                                                                                                PID:4976
                                                                                                                                • C:\Program Files\Java\jre1.8.0_66\lib\amd64\backup.exe
                                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\lib\amd64\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\amd64\
                                                                                                                                  8⤵
                                                                                                                                    PID:3948
                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\ext\update.exe
                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\ext\update.exe" C:\Program Files\Java\jre1.8.0_66\lib\ext\
                                                                                                                                    8⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • System policy modification
                                                                                                                                    PID:1420
                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe
                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\deploy\
                                                                                                                                    8⤵
                                                                                                                                      PID:740
                                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe
                                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\cmm\
                                                                                                                                      8⤵
                                                                                                                                      • System policy modification
                                                                                                                                      PID:4740
                                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe
                                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\applet\
                                                                                                                                      8⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      PID:4564
                                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe
                                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\fonts\
                                                                                                                                      8⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      PID:3760
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
                                                                                                                                  6⤵
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  PID:5032
                                                                                                                              • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                                "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                                5⤵
                                                                                                                                  PID:2320
                                                                                                                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                                    6⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    PID:5000
                                                                                                                                  • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                                                    "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                                    6⤵
                                                                                                                                      PID:1032
                                                                                                                                    • C:\Program Files\Microsoft Office\root\data.exe
                                                                                                                                      "C:\Program Files\Microsoft Office\root\data.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                                      6⤵
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      PID:3836
                                                                                                                                      • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                                                                        "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                                                        7⤵
                                                                                                                                          PID:3212
                                                                                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                                                          7⤵
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:1336
                                                                                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                                                                            "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                                            8⤵
                                                                                                                                              PID:2584
                                                                                                                                            • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                                                                                              "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                                                                                              8⤵
                                                                                                                                                PID:5052
                                                                                                                                              • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
                                                                                                                                                "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
                                                                                                                                                8⤵
                                                                                                                                                  PID:3620
                                                                                                                                              • C:\Program Files\Microsoft Office\root\fre\backup.exe
                                                                                                                                                "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
                                                                                                                                                7⤵
                                                                                                                                                  PID:2788
                                                                                                                                                • C:\Program Files\Microsoft Office\root\Licenses\backup.exe
                                                                                                                                                  "C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\
                                                                                                                                                  7⤵
                                                                                                                                                    PID:3776
                                                                                                                                                  • C:\Program Files\Microsoft Office\root\Integration\backup.exe
                                                                                                                                                    "C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\
                                                                                                                                                    7⤵
                                                                                                                                                      PID:3296
                                                                                                                                                    • C:\Program Files\Microsoft Office\root\Licenses16\backup.exe
                                                                                                                                                      "C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\
                                                                                                                                                      7⤵
                                                                                                                                                        PID:2436
                                                                                                                                                    • C:\Program Files\Microsoft Office\Updates\backup.exe
                                                                                                                                                      "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
                                                                                                                                                      6⤵
                                                                                                                                                        PID:3424
                                                                                                                                                        • C:\Program Files\Microsoft Office\Updates\Apply\backup.exe
                                                                                                                                                          "C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\
                                                                                                                                                          7⤵
                                                                                                                                                            PID:1892
                                                                                                                                                            • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe
                                                                                                                                                              "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\
                                                                                                                                                              8⤵
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              PID:780
                                                                                                                                                              • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe
                                                                                                                                                                "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B11EF506-7DE1-455F-8E20-67264DD4AF60\
                                                                                                                                                                9⤵
                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                PID:1036
                                                                                                                                                          • C:\Program Files\Microsoft Office\Updates\Download\backup.exe
                                                                                                                                                            "C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\
                                                                                                                                                            7⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            PID:4696
                                                                                                                                                            • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe
                                                                                                                                                              "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\
                                                                                                                                                              8⤵
                                                                                                                                                                PID:2912
                                                                                                                                                                • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\System Restore.exe
                                                                                                                                                                  "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\System Restore.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:728
                                                                                                                                                          • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                                                                            "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                                                                            5⤵
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            PID:5068
                                                                                                                                                            • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                                                                                                              "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                                                                                              6⤵
                                                                                                                                                                PID:380
                                                                                                                                                            • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                                                                              "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                                                                              5⤵
                                                                                                                                                                PID:3076
                                                                                                                                                                • C:\Program Files\Mozilla Firefox\defaults\backup.exe
                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:2284
                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:3784
                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      PID:5060
                                                                                                                                                                • C:\Program Files (x86)\data.exe
                                                                                                                                                                  "C:\Program Files (x86)\data.exe" C:\Program Files (x86)\
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  • System policy modification
                                                                                                                                                                  PID:2372
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:3412
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:3424
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                        PID:3060
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                        PID:1900
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                                                          8⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:1964
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:4084
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                                                          8⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2016
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\System Restore.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:1028
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:3032
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:4892
                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:4980
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                                                                    9⤵
                                                                                                                                                                                      PID:1892
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\data.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                    PID:2128
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\System Restore.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                                                                      9⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      PID:4104
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:3436
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                                                                      8⤵
                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                      PID:2912
                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                                                        9⤵
                                                                                                                                                                                          PID:3276
                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\update.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                                                                        8⤵
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        PID:2164
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                                                          9⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          PID:4536
                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                                                                        8⤵
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        PID:1224
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                                                                          9⤵
                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                          PID:1240
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                                                            10⤵
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:2360
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                                                          9⤵
                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                          PID:3440
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                                                            10⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            PID:3276
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                                                              11⤵
                                                                                                                                                                                                PID:1008
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\update.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                                                                                                                            9⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            PID:1220
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\data.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                                                                              10⤵
                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                              PID:4220
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                                                                                                                            9⤵
                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                            PID:4316
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                                                                          8⤵
                                                                                                                                                                                            PID:1524
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                                                                                              9⤵
                                                                                                                                                                                                PID:3924
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:3840
                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                PID:3380
                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                PID:2360
                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                    PID:884
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:3484
                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\System Restore.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                  PID:4872
                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                      PID:4212
                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:4028
                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                            PID:3344
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                              PID:960
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                              PID:2288
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                PID:3004
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                  PID:4024
                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                  PID:3336
                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                PID:1480
                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                          PID:3132
                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            PID:1136
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                              PID:1532
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:1968
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:3200
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:1864
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      PID:1320
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                          PID:4440
                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                            PID:1596
                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                PID:3996
                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\data.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                  PID:1252
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                      PID:3476
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\update.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          PID:32
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                            PID:3568
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                              PID:3848
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\
                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                              PID:596
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\
                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            PID:1972
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\
                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                PID:312
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                PID:3668
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                  PID:3800
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\update.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\System Restore.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                    PID:3548
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    PID:2304
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                      PID:3272
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                  PID:4164
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Java\data.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Java\data.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                        PID:2732
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Java\Java Update\data.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Java\Java Update\data.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                            PID:3352
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:4924
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                PID:2128
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                PID:4940
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\data.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:4308
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                      PID:3848
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:3416
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                        PID:4860
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    PID:2744
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\System\ado\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                        PID:4832
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                          PID:2168
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                    PID:4072
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:2760
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                        PID:3104
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Temp\System Restore.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Temp\System Restore.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                        PID:4140
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                          PID:3884
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                          PID:1252
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:1480
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                            PID:2980
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:4032
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:3732
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\images\update.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\images\update.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:1604
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\backup.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                  PID:2140
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:4248
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:1016
                                                                                                                                                                                                                                                                • C:\Users\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                  • C:\Users\Public\backup.exe
                                                                                                                                                                                                                                                                    C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:3960
                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:3312
                                                                                                                                                                                                                                                                        • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                                                                          C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:3996
                                                                                                                                                                                                                                                                            • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                                                                                                                                                              C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:3476
                                                                                                                                                                                                                                                                            • C:\Users\Public\Music\update.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Music\update.exe C:\Users\Public\Music\
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                              PID:1312
                                                                                                                                                                                                                                                                            • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:2304
                                                                                                                                                                                                                                                                              • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                                                                C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                                                                          • C:\Windows\backup.exe
                                                                                                                                                                                                                                                                            C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:2880
                                                                                                                                                                                                                                                                            • C:\Windows\addins\backup.exe
                                                                                                                                                                                                                                                                              C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:784
                                                                                                                                                                                                                                                                              • C:\Windows\appcompat\backup.exe
                                                                                                                                                                                                                                                                                C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:3020
                                                                                                                                                                                                                                                                                • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                                                                                                                  C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                  PID:236
                                                                                                                                                                                                                                                                                  • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                    PID:3096
                                                                                                                                                                                                                                                                                • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                                                                                                  C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:840
                                                                                                                                                                                                                                                                                  • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                                                                                                • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                                                                                                                  C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                    PID:2208
                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                    PID:4724
                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:3996
                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                    PID:1064
                                                                                                                                                                                                                                                                                • C:\Windows\AppReadiness\backup.exe
                                                                                                                                                                                                                                                                                  C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                  PID:3744
                                                                                                                                                                                                                                                                                • C:\Windows\assembly\backup.exe
                                                                                                                                                                                                                                                                                  C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                                                  • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:4436
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:4024
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:4028
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:1828
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:4380
                                                                                                                                                                                                                                                                        • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:292
                                                                                                                                                                                                                                                                            • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                              PID:3312
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Contacts\data.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\Contacts\data.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:3104
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3640
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1300
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:1112
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:4280
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                        PID:4556
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:4752
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                            PID:4456
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                            PID:3616
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                            PID:3684
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                            PID:3064
                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:4828
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:1120
                                                                                                                                                                                                                                                                                            • C:\Windows\assembly\GAC\ADODB\backup.exe
                                                                                                                                                                                                                                                                                              C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                              PID:516
                                                                                                                                                                                                                                                                                              • C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                                                                                                C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:2072
                                                                                                                                                                                                                                                                                              • C:\Windows\assembly\GAC\Extensibility\backup.exe
                                                                                                                                                                                                                                                                                                C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                PID:1020
                                                                                                                                                                                                                                                                                                • C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                                  PID:1456
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:944
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                    PID:236
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:1532
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:804
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                            PID:3408
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1620
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:980
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:2056

                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                              • C:\PerfLogs\System Restore.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                9c700f85e54c0dbf34ff5783895b2b0d

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                3871d1f38f45b90bfeac1c34ca5db33b238e2510

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                f2ff2fefd6535ab082de3854d51e85e471ae681a281c915157b06da1523824df

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                833e7908dd8843a245fa7b3fbdcabcf712e0e899aa57a06be53f9c90b92e46d5349f1ee661bb137b36e067c59762ba97529368256cdd8d2693f7da432c43f2d4

                                                                                                                                                                                                                                                                                                              • C:\PerfLogs\System Restore.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                9c700f85e54c0dbf34ff5783895b2b0d

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                3871d1f38f45b90bfeac1c34ca5db33b238e2510

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                f2ff2fefd6535ab082de3854d51e85e471ae681a281c915157b06da1523824df

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                833e7908dd8843a245fa7b3fbdcabcf712e0e899aa57a06be53f9c90b92e46d5349f1ee661bb137b36e067c59762ba97529368256cdd8d2693f7da432c43f2d4

                                                                                                                                                                                                                                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                43cb6562b7b7f298df12152fa7b45f38

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                3c0406d463c4314438a34ecca9c1d2f03e6713c0

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                68e523135f3e4c1594cecc655559ace2c29a6161615884024f76f16d5ba178e9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                ab4f7462b8650a93b1a7bd19d154de0d4d2df737d4ca463d8a0f361bc49d949fc84560e77293bb1080936159a169d160fba94a5acb32e1e37e34102def74dfa6

                                                                                                                                                                                                                                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                43cb6562b7b7f298df12152fa7b45f38

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                3c0406d463c4314438a34ecca9c1d2f03e6713c0

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                68e523135f3e4c1594cecc655559ace2c29a6161615884024f76f16d5ba178e9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                ab4f7462b8650a93b1a7bd19d154de0d4d2df737d4ca463d8a0f361bc49d949fc84560e77293bb1080936159a169d160fba94a5acb32e1e37e34102def74dfa6

                                                                                                                                                                                                                                                                                                              • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3b8044a71381bc4c0581c57d7d0dc24d

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                56b092b1ea942b3a6a437d314cc2be6b7acb28ea

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                ed5acd6de8a8bc99d2571b6449cb582ab50cdc9a963b79f66605193d7abb7b80

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                77d27c0c04b055d2a1f1cd4278af68267725bff7d83eaf184fee1ef9cdc8ab95becc8615fa80ae814d51e98b9f0735a7552ab4e9b6456a239f355d8dff6cbd2d

                                                                                                                                                                                                                                                                                                              • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3b8044a71381bc4c0581c57d7d0dc24d

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                56b092b1ea942b3a6a437d314cc2be6b7acb28ea

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                ed5acd6de8a8bc99d2571b6449cb582ab50cdc9a963b79f66605193d7abb7b80

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                77d27c0c04b055d2a1f1cd4278af68267725bff7d83eaf184fee1ef9cdc8ab95becc8615fa80ae814d51e98b9f0735a7552ab4e9b6456a239f355d8dff6cbd2d

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                45e0d9c3c7ab2a4ad86a5e01ae54586b

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                35b18fd1c5db09234115053d97f894f4f6a0dfa7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2a2adbb47936b0357facd6576a6a6a561d031b9ff22fd77f9000011e76b15558

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f16246fb710df3a84ca6de4fec9140604412237209f8cd12dc41b0bd32dca51d3812d590a30614985605f1955d2616545806ca4a1a87452ee7ad94a3da968531

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                45e0d9c3c7ab2a4ad86a5e01ae54586b

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                35b18fd1c5db09234115053d97f894f4f6a0dfa7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2a2adbb47936b0357facd6576a6a6a561d031b9ff22fd77f9000011e76b15558

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f16246fb710df3a84ca6de4fec9140604412237209f8cd12dc41b0bd32dca51d3812d590a30614985605f1955d2616545806ca4a1a87452ee7ad94a3da968531

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3b8044a71381bc4c0581c57d7d0dc24d

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                56b092b1ea942b3a6a437d314cc2be6b7acb28ea

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                ed5acd6de8a8bc99d2571b6449cb582ab50cdc9a963b79f66605193d7abb7b80

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                77d27c0c04b055d2a1f1cd4278af68267725bff7d83eaf184fee1ef9cdc8ab95becc8615fa80ae814d51e98b9f0735a7552ab4e9b6456a239f355d8dff6cbd2d

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3b8044a71381bc4c0581c57d7d0dc24d

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                56b092b1ea942b3a6a437d314cc2be6b7acb28ea

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                ed5acd6de8a8bc99d2571b6449cb582ab50cdc9a963b79f66605193d7abb7b80

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                77d27c0c04b055d2a1f1cd4278af68267725bff7d83eaf184fee1ef9cdc8ab95becc8615fa80ae814d51e98b9f0735a7552ab4e9b6456a239f355d8dff6cbd2d

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                cfd6d798897496d5f2ffb82d29eb8285

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                2641fe29bec432f85be12baf38b829f311f94cf3

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                646aeda7dc5b03aac6c3ac0061e7c91a70e881183ee894ac50086ba3a5129fa2

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                3874a7bdc24d1a7dec3c7fae2e3f7718c3815008fe61db122ac06a7983a4228885804831820ebed05fc1b3688725c36125f4f887680b341b4aff609a69195eee

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                cfd6d798897496d5f2ffb82d29eb8285

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                2641fe29bec432f85be12baf38b829f311f94cf3

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                646aeda7dc5b03aac6c3ac0061e7c91a70e881183ee894ac50086ba3a5129fa2

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                3874a7bdc24d1a7dec3c7fae2e3f7718c3815008fe61db122ac06a7983a4228885804831820ebed05fc1b3688725c36125f4f887680b341b4aff609a69195eee

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                45e0d9c3c7ab2a4ad86a5e01ae54586b

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                35b18fd1c5db09234115053d97f894f4f6a0dfa7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2a2adbb47936b0357facd6576a6a6a561d031b9ff22fd77f9000011e76b15558

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f16246fb710df3a84ca6de4fec9140604412237209f8cd12dc41b0bd32dca51d3812d590a30614985605f1955d2616545806ca4a1a87452ee7ad94a3da968531

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                45e0d9c3c7ab2a4ad86a5e01ae54586b

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                35b18fd1c5db09234115053d97f894f4f6a0dfa7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2a2adbb47936b0357facd6576a6a6a561d031b9ff22fd77f9000011e76b15558

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f16246fb710df3a84ca6de4fec9140604412237209f8cd12dc41b0bd32dca51d3812d590a30614985605f1955d2616545806ca4a1a87452ee7ad94a3da968531

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3561f387e5dca0dcd3520fc2b3fc0f65

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ea55d811b0016fe5445d51bc8dcff7b4a5c862a2

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                3b7a957aa3d37d1898fdfdb40fb47535f892a2e83a1fa926ede30eba18ffa146

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                831bc9eb73eaada9d3f76e68991ce11db0afcf2dff98f62afb3309d4994cc719258e35be8ae5f4e5e8d35e96a09e3f204a4d87c76db083da426a7cc71cfb570d

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3561f387e5dca0dcd3520fc2b3fc0f65

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ea55d811b0016fe5445d51bc8dcff7b4a5c862a2

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                3b7a957aa3d37d1898fdfdb40fb47535f892a2e83a1fa926ede30eba18ffa146

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                831bc9eb73eaada9d3f76e68991ce11db0afcf2dff98f62afb3309d4994cc719258e35be8ae5f4e5e8d35e96a09e3f204a4d87c76db083da426a7cc71cfb570d

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                cfd6d798897496d5f2ffb82d29eb8285

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                2641fe29bec432f85be12baf38b829f311f94cf3

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                646aeda7dc5b03aac6c3ac0061e7c91a70e881183ee894ac50086ba3a5129fa2

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                3874a7bdc24d1a7dec3c7fae2e3f7718c3815008fe61db122ac06a7983a4228885804831820ebed05fc1b3688725c36125f4f887680b341b4aff609a69195eee

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                cfd6d798897496d5f2ffb82d29eb8285

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                2641fe29bec432f85be12baf38b829f311f94cf3

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                646aeda7dc5b03aac6c3ac0061e7c91a70e881183ee894ac50086ba3a5129fa2

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                3874a7bdc24d1a7dec3c7fae2e3f7718c3815008fe61db122ac06a7983a4228885804831820ebed05fc1b3688725c36125f4f887680b341b4aff609a69195eee

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3561f387e5dca0dcd3520fc2b3fc0f65

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ea55d811b0016fe5445d51bc8dcff7b4a5c862a2

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                3b7a957aa3d37d1898fdfdb40fb47535f892a2e83a1fa926ede30eba18ffa146

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                831bc9eb73eaada9d3f76e68991ce11db0afcf2dff98f62afb3309d4994cc719258e35be8ae5f4e5e8d35e96a09e3f204a4d87c76db083da426a7cc71cfb570d

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3561f387e5dca0dcd3520fc2b3fc0f65

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ea55d811b0016fe5445d51bc8dcff7b4a5c862a2

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                3b7a957aa3d37d1898fdfdb40fb47535f892a2e83a1fa926ede30eba18ffa146

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                831bc9eb73eaada9d3f76e68991ce11db0afcf2dff98f62afb3309d4994cc719258e35be8ae5f4e5e8d35e96a09e3f204a4d87c76db083da426a7cc71cfb570d

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                b42794e04a9e6cefca415412355f3ffd

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                56324c727c84e8cf5012d4c4b00c87aa8d6dfd85

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                ab7e1559ad2f3cf40005869f0d869fbe713d7c379bf1ad3c586c208c64c682a6

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                635847f8ae85f1dc24cf7f0ecd7b3c42a14cab9b907e811e12707afd5d5e8dfcf188c2d24664c62d700665c3660e104ecb8c9825cf325e3db6449a89176d30b4

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                b42794e04a9e6cefca415412355f3ffd

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                56324c727c84e8cf5012d4c4b00c87aa8d6dfd85

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                ab7e1559ad2f3cf40005869f0d869fbe713d7c379bf1ad3c586c208c64c682a6

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                635847f8ae85f1dc24cf7f0ecd7b3c42a14cab9b907e811e12707afd5d5e8dfcf188c2d24664c62d700665c3660e104ecb8c9825cf325e3db6449a89176d30b4

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                7c34b9aa8f1fa65c2373fa835378d850

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                c7586312f332d4e4d9a9986698cbfde601b9a47e

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                07bb22f8a6cf043c9e0dfb3fdcf8b1d8456e9ad4e0c1f57d90742efd84594ef9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                74afc6750e58dd737d7d0508918e0da1ccbf06558e9181350da78c03ea12c62af9e81060116216700a21caf8878d52f4649173cfbe4328703483e888d9805ffb

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                7c34b9aa8f1fa65c2373fa835378d850

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                c7586312f332d4e4d9a9986698cbfde601b9a47e

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                07bb22f8a6cf043c9e0dfb3fdcf8b1d8456e9ad4e0c1f57d90742efd84594ef9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                74afc6750e58dd737d7d0508918e0da1ccbf06558e9181350da78c03ea12c62af9e81060116216700a21caf8878d52f4649173cfbe4328703483e888d9805ffb

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                7c34b9aa8f1fa65c2373fa835378d850

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                c7586312f332d4e4d9a9986698cbfde601b9a47e

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                07bb22f8a6cf043c9e0dfb3fdcf8b1d8456e9ad4e0c1f57d90742efd84594ef9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                74afc6750e58dd737d7d0508918e0da1ccbf06558e9181350da78c03ea12c62af9e81060116216700a21caf8878d52f4649173cfbe4328703483e888d9805ffb

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                7c34b9aa8f1fa65c2373fa835378d850

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                c7586312f332d4e4d9a9986698cbfde601b9a47e

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                07bb22f8a6cf043c9e0dfb3fdcf8b1d8456e9ad4e0c1f57d90742efd84594ef9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                74afc6750e58dd737d7d0508918e0da1ccbf06558e9181350da78c03ea12c62af9e81060116216700a21caf8878d52f4649173cfbe4328703483e888d9805ffb

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                7c34b9aa8f1fa65c2373fa835378d850

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                c7586312f332d4e4d9a9986698cbfde601b9a47e

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                07bb22f8a6cf043c9e0dfb3fdcf8b1d8456e9ad4e0c1f57d90742efd84594ef9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                74afc6750e58dd737d7d0508918e0da1ccbf06558e9181350da78c03ea12c62af9e81060116216700a21caf8878d52f4649173cfbe4328703483e888d9805ffb

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                7c34b9aa8f1fa65c2373fa835378d850

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                c7586312f332d4e4d9a9986698cbfde601b9a47e

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                07bb22f8a6cf043c9e0dfb3fdcf8b1d8456e9ad4e0c1f57d90742efd84594ef9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                74afc6750e58dd737d7d0508918e0da1ccbf06558e9181350da78c03ea12c62af9e81060116216700a21caf8878d52f4649173cfbe4328703483e888d9805ffb

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                3179b0be180688311cb8acfe6cc263fc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                ab1bccb6633a3cd291cf34ceb6f4d24cbdf97ac7

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                cf769e2278fa48d637ca89667815b72532a7dcf232f42d088e1554c643eb907a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f8318060c74d6964da85702a22074ed311a91bcfc71301d01948820d704e6f71e4a59d352ff623282918ba741c0335042c96fbc1821472f84494655882ed463c

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                384f213143f05773ea0f864dd01e7d29

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                8e9f0497fe010d88882d90ebbbb914850bf19d67

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                edba36233622b5b476841c87043aa95a39e1e4189bd02c3e45ddfb0edd74b657

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                9acc19c56d9a3e8aa413c2f6e8fec2cd2dd8754a24e1d185676515dfab91804641834a9535e173bd24f2101a18da492a0d0b3b46a46652423d9a895157de9eef

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                384f213143f05773ea0f864dd01e7d29

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                8e9f0497fe010d88882d90ebbbb914850bf19d67

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                edba36233622b5b476841c87043aa95a39e1e4189bd02c3e45ddfb0edd74b657

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                9acc19c56d9a3e8aa413c2f6e8fec2cd2dd8754a24e1d185676515dfab91804641834a9535e173bd24f2101a18da492a0d0b3b46a46652423d9a895157de9eef

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                384f213143f05773ea0f864dd01e7d29

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                8e9f0497fe010d88882d90ebbbb914850bf19d67

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                edba36233622b5b476841c87043aa95a39e1e4189bd02c3e45ddfb0edd74b657

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                9acc19c56d9a3e8aa413c2f6e8fec2cd2dd8754a24e1d185676515dfab91804641834a9535e173bd24f2101a18da492a0d0b3b46a46652423d9a895157de9eef

                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                384f213143f05773ea0f864dd01e7d29

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                8e9f0497fe010d88882d90ebbbb914850bf19d67

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                edba36233622b5b476841c87043aa95a39e1e4189bd02c3e45ddfb0edd74b657

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                9acc19c56d9a3e8aa413c2f6e8fec2cd2dd8754a24e1d185676515dfab91804641834a9535e173bd24f2101a18da492a0d0b3b46a46652423d9a895157de9eef

                                                                                                                                                                                                                                                                                                              • C:\Program Files\update.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                38bd921b5b1b179d066773dabc60b8ec

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                a9662a3dc229a405593cf541ab13e046142274dc

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                c0e2cac2a41d4b4c2197c5190993328dca1ab6fd1eb67c0748e6eecbce0f9e4e

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                e0a36dd1d6ea25f5c163aa783feebb32d6f64f16436c77c770bb152f385c42e9a08650a79f5b567fd407b0c59b75c9a1fd47906e0eb8f731ec6a8e83d0c7057d

                                                                                                                                                                                                                                                                                                              • C:\Program Files\update.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                38bd921b5b1b179d066773dabc60b8ec

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                a9662a3dc229a405593cf541ab13e046142274dc

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                c0e2cac2a41d4b4c2197c5190993328dca1ab6fd1eb67c0748e6eecbce0f9e4e

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                e0a36dd1d6ea25f5c163aa783feebb32d6f64f16436c77c770bb152f385c42e9a08650a79f5b567fd407b0c59b75c9a1fd47906e0eb8f731ec6a8e83d0c7057d

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\183495482\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                ee6ed39975dbd31d30641e5bbd09828f

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                db260b5bdc9d973ca076054220df3cf907b5c840

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                90dc256dbfb0279bfd7f08ae7f91a8cc285bdc48773e0ae4ca618f0324f50324

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                7b6921eac00d0ebfadc153605d48d69baf4b1a39bfb0773f774a36185246f5b702d7a0b8d0ad8402dfa953b071f4d7bb14979bda4795b48a299268deaa1128b4

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\183495482\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                ee6ed39975dbd31d30641e5bbd09828f

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                db260b5bdc9d973ca076054220df3cf907b5c840

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                90dc256dbfb0279bfd7f08ae7f91a8cc285bdc48773e0ae4ca618f0324f50324

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                7b6921eac00d0ebfadc153605d48d69baf4b1a39bfb0773f774a36185246f5b702d7a0b8d0ad8402dfa953b071f4d7bb14979bda4795b48a299268deaa1128b4

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                4e2e1ee2729607df12066c69d4e75be7

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                d0698aebd68d997d08ea304b9ba8ef826e1f0054

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2eb81d9108a4faa3d357655d655d7353a961ff7f0529c9e406520f0ccdad0776

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                0f34d262d938813a6c071403dd6ced40f18363b6bc503caed41f75a34dab2144fe9f67de587d49a203e31ed77ad46821957e58f3174e38b976079a8606e01857

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                4e2e1ee2729607df12066c69d4e75be7

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                d0698aebd68d997d08ea304b9ba8ef826e1f0054

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2eb81d9108a4faa3d357655d655d7353a961ff7f0529c9e406520f0ccdad0776

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                0f34d262d938813a6c071403dd6ced40f18363b6bc503caed41f75a34dab2144fe9f67de587d49a203e31ed77ad46821957e58f3174e38b976079a8606e01857

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                4e2e1ee2729607df12066c69d4e75be7

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                d0698aebd68d997d08ea304b9ba8ef826e1f0054

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2eb81d9108a4faa3d357655d655d7353a961ff7f0529c9e406520f0ccdad0776

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                0f34d262d938813a6c071403dd6ced40f18363b6bc503caed41f75a34dab2144fe9f67de587d49a203e31ed77ad46821957e58f3174e38b976079a8606e01857

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                4e2e1ee2729607df12066c69d4e75be7

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                d0698aebd68d997d08ea304b9ba8ef826e1f0054

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2eb81d9108a4faa3d357655d655d7353a961ff7f0529c9e406520f0ccdad0776

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                0f34d262d938813a6c071403dd6ced40f18363b6bc503caed41f75a34dab2144fe9f67de587d49a203e31ed77ad46821957e58f3174e38b976079a8606e01857

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                4e2e1ee2729607df12066c69d4e75be7

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                d0698aebd68d997d08ea304b9ba8ef826e1f0054

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2eb81d9108a4faa3d357655d655d7353a961ff7f0529c9e406520f0ccdad0776

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                0f34d262d938813a6c071403dd6ced40f18363b6bc503caed41f75a34dab2144fe9f67de587d49a203e31ed77ad46821957e58f3174e38b976079a8606e01857

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                4e2e1ee2729607df12066c69d4e75be7

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                d0698aebd68d997d08ea304b9ba8ef826e1f0054

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                2eb81d9108a4faa3d357655d655d7353a961ff7f0529c9e406520f0ccdad0776

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                0f34d262d938813a6c071403dd6ced40f18363b6bc503caed41f75a34dab2144fe9f67de587d49a203e31ed77ad46821957e58f3174e38b976079a8606e01857

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                949d1248f984032ff9437bcf56b1b041

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                27f172a76fd3dd86467f7aa2c396d189d7b5a82b

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                7392b4e0ccad7561c93cbc1b67771ed6d90bdf8527955a6bea710dbc1ff66ee9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                69956af9854933877c079f27e96f9a80aef3fed397efd017f539254fd9dbd319e5ac3484a212fa165bc3049ed5dd976ca92258c64043dd7b022a992b192a2408

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                949d1248f984032ff9437bcf56b1b041

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                27f172a76fd3dd86467f7aa2c396d189d7b5a82b

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                7392b4e0ccad7561c93cbc1b67771ed6d90bdf8527955a6bea710dbc1ff66ee9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                69956af9854933877c079f27e96f9a80aef3fed397efd017f539254fd9dbd319e5ac3484a212fa165bc3049ed5dd976ca92258c64043dd7b022a992b192a2408

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                949d1248f984032ff9437bcf56b1b041

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                27f172a76fd3dd86467f7aa2c396d189d7b5a82b

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                7392b4e0ccad7561c93cbc1b67771ed6d90bdf8527955a6bea710dbc1ff66ee9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                69956af9854933877c079f27e96f9a80aef3fed397efd017f539254fd9dbd319e5ac3484a212fa165bc3049ed5dd976ca92258c64043dd7b022a992b192a2408

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                949d1248f984032ff9437bcf56b1b041

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                27f172a76fd3dd86467f7aa2c396d189d7b5a82b

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                7392b4e0ccad7561c93cbc1b67771ed6d90bdf8527955a6bea710dbc1ff66ee9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                69956af9854933877c079f27e96f9a80aef3fed397efd017f539254fd9dbd319e5ac3484a212fa165bc3049ed5dd976ca92258c64043dd7b022a992b192a2408

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                d2e39fe6fc1319408dc24e1a43c6a332

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                fba26d2bfcfabb887ca13dc833314ad1d2c371f3

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                84e1f735849ce7ea1729d03f0b2dba568f82cbcd6eca1d4cb408b8a13636f3dd

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                b0d777d99932dc8219a197026761c9b518aa16bdb48dd9205f3cb53e3fc69559f36f3d0d1e0b7fdbcc5d6e164f1f99f57c66c45a59323c5f32a89c44c296cbd7

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                d2e39fe6fc1319408dc24e1a43c6a332

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                fba26d2bfcfabb887ca13dc833314ad1d2c371f3

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                84e1f735849ce7ea1729d03f0b2dba568f82cbcd6eca1d4cb408b8a13636f3dd

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                b0d777d99932dc8219a197026761c9b518aa16bdb48dd9205f3cb53e3fc69559f36f3d0d1e0b7fdbcc5d6e164f1f99f57c66c45a59323c5f32a89c44c296cbd7

                                                                                                                                                                                                                                                                                                              • C:\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                bf982c5a22fd96ef3a660e56359b5ebc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                b65b6690e1445d3a3b443e77e275dc0458d91404

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                7b0ca26181ef123142b19b7bfcb5ee0921196dc7f536105291bcbc2ce5f6ac99

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                d17d5297e2c6279624e974e8092e562672841a7e51cee52b08e47e3508494c040063734aa6bcab85c60d34b8c671a8e3635de4fdca0e42da8e8e3e7764d84fe4

                                                                                                                                                                                                                                                                                                              • C:\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                bf982c5a22fd96ef3a660e56359b5ebc

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                b65b6690e1445d3a3b443e77e275dc0458d91404

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                7b0ca26181ef123142b19b7bfcb5ee0921196dc7f536105291bcbc2ce5f6ac99

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                d17d5297e2c6279624e974e8092e562672841a7e51cee52b08e47e3508494c040063734aa6bcab85c60d34b8c671a8e3635de4fdca0e42da8e8e3e7764d84fe4

                                                                                                                                                                                                                                                                                                              • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                9c700f85e54c0dbf34ff5783895b2b0d

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                3871d1f38f45b90bfeac1c34ca5db33b238e2510

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                f2ff2fefd6535ab082de3854d51e85e471ae681a281c915157b06da1523824df

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                833e7908dd8843a245fa7b3fbdcabcf712e0e899aa57a06be53f9c90b92e46d5349f1ee661bb137b36e067c59762ba97529368256cdd8d2693f7da432c43f2d4

                                                                                                                                                                                                                                                                                                              • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                9c700f85e54c0dbf34ff5783895b2b0d

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                3871d1f38f45b90bfeac1c34ca5db33b238e2510

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                f2ff2fefd6535ab082de3854d51e85e471ae681a281c915157b06da1523824df

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                833e7908dd8843a245fa7b3fbdcabcf712e0e899aa57a06be53f9c90b92e46d5349f1ee661bb137b36e067c59762ba97529368256cdd8d2693f7da432c43f2d4