Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 06:21

General

  • Target

    29246df3d9e22652ffaf0c5b7221624a6c5e5be4d731674d88d8a30ce16e7f1f.exe

  • Size

    72KB

  • MD5

    6970d11c41cae86bc21b2c1792a39fcc

  • SHA1

    79fbc80d183b056b5397206ef463c0c62ed257f2

  • SHA256

    29246df3d9e22652ffaf0c5b7221624a6c5e5be4d731674d88d8a30ce16e7f1f

  • SHA512

    209ef1d21106345a8f1b3000447673fb24a6e210134d54e2312d9b02c05a3ec38aff7bec969856e5f3d842b822d641874b4c6a2c9ceb200613f1f916a8e69f8b

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2L:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr3

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29246df3d9e22652ffaf0c5b7221624a6c5e5be4d731674d88d8a30ce16e7f1f.exe
    "C:\Users\Admin\AppData\Local\Temp\29246df3d9e22652ffaf0c5b7221624a6c5e5be4d731674d88d8a30ce16e7f1f.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Users\Admin\AppData\Local\Temp\3706937728\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3706937728\backup.exe C:\Users\Admin\AppData\Local\Temp\3706937728\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3968
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3560
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1648
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:4528
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1604
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:208
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1488
          • C:\Program Files\Common Files\update.exe
            "C:\Program Files\Common Files\update.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1676
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1428
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4488
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2492
              • C:\Program Files\Common Files\microsoft shared\ink\update.exe
                "C:\Program Files\Common Files\microsoft shared\ink\update.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2564
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2712
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3656
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3900
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\update.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2180
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:992
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1044
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4404
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2668
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3924
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:840
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2908
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4860
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3360
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2144
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:392
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5088
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1716
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4796
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3608
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3080
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3460
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\System Restore.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3272
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2168
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3804
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2072
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4272
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:400
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1188
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\data.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:924
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3728
                • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1688
                • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3180
                • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5052
                • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4908
                • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:752
                • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4232
                • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4476
                • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3552
                • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2088
                • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3380
                • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:320
                • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1212
                • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1488
                • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4248
                • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\update.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4612
                • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                  8⤵
                  • Executes dropped EXE
                  PID:1756
                • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                  8⤵
                    PID:1224
                  • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                    8⤵
                      PID:1348
                    • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                      8⤵
                        PID:3304
                      • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                        8⤵
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:3276
                      • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:1832
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                      7⤵
                      • Disables RegEdit via registry modification
                      • Drops file in Program Files directory
                      PID:3984
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:2320
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                        8⤵
                          PID:988
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                          8⤵
                            PID:2600
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                            8⤵
                              PID:4864
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                              8⤵
                                PID:760
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                PID:1996
                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                              7⤵
                              • Drops file in Program Files directory
                              PID:712
                              • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                8⤵
                                  PID:1940
                              • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                7⤵
                                • System policy modification
                                PID:1960
                              • C:\Program Files\Common Files\microsoft shared\Source Engine\data.exe
                                "C:\Program Files\Common Files\microsoft shared\Source Engine\data.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                7⤵
                                • System policy modification
                                PID:4868
                              • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                7⤵
                                  PID:2168
                                • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                  7⤵
                                    PID:3100
                                    • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                      8⤵
                                        PID:1688
                                    • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:1392
                                      • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                        8⤵
                                          PID:4136
                                      • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                        7⤵
                                          PID:2832
                                        • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                          7⤵
                                            PID:1704
                                          • C:\Program Files\Common Files\microsoft shared\VSTO\data.exe
                                            "C:\Program Files\Common Files\microsoft shared\VSTO\data.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                            7⤵
                                            • System policy modification
                                            PID:1224
                                            • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                              8⤵
                                                PID:4852
                                                • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                  9⤵
                                                  • Disables RegEdit via registry modification
                                                  PID:992
                                          • C:\Program Files\Common Files\Services\backup.exe
                                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:3332
                                          • C:\Program Files\Common Files\System\backup.exe
                                            "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Drops file in Program Files directory
                                            PID:3920
                                            • C:\Program Files\Common Files\System\ado\backup.exe
                                              "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                              7⤵
                                                PID:1448
                                                • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                  8⤵
                                                  • Disables RegEdit via registry modification
                                                  PID:1524
                                                • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                  8⤵
                                                  • System policy modification
                                                  PID:2220
                                                • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                  8⤵
                                                    PID:5008
                                                  • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                    8⤵
                                                    • System policy modification
                                                    PID:5048
                                                  • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                    8⤵
                                                      PID:4784
                                                    • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                      8⤵
                                                        PID:4484
                                                    • C:\Program Files\Common Files\System\de-DE\System Restore.exe
                                                      "C:\Program Files\Common Files\System\de-DE\System Restore.exe" C:\Program Files\Common Files\System\de-DE\
                                                      7⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      PID:2784
                                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                      7⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      PID:1984
                                                    • C:\Program Files\Common Files\System\es-ES\data.exe
                                                      "C:\Program Files\Common Files\System\es-ES\data.exe" C:\Program Files\Common Files\System\es-ES\
                                                      7⤵
                                                        PID:1276
                                                      • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                        7⤵
                                                          PID:3308
                                                        • C:\Program Files\Common Files\System\it-IT\update.exe
                                                          "C:\Program Files\Common Files\System\it-IT\update.exe" C:\Program Files\Common Files\System\it-IT\
                                                          7⤵
                                                          • Disables RegEdit via registry modification
                                                          PID:3580
                                                        • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                          "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                          7⤵
                                                            PID:2688
                                                          • C:\Program Files\Common Files\System\msadc\backup.exe
                                                            "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                            7⤵
                                                            • System policy modification
                                                            PID:5104
                                                            • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                              "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                              8⤵
                                                                PID:1916
                                                              • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:2144
                                                              • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                8⤵
                                                                  PID:3152
                                                                • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                  8⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:1308
                                                                • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System policy modification
                                                                  PID:2256
                                                                • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                  8⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:4668
                                                              • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                7⤵
                                                                • Drops file in Program Files directory
                                                                • System policy modification
                                                                PID:4476
                                                                • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:4136
                                                                • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:5040
                                                                • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                  8⤵
                                                                    PID:4696
                                                                  • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                    "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                    8⤵
                                                                      PID:4764
                                                                    • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                      "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                      8⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      PID:2332
                                                                    • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                      "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                      8⤵
                                                                        PID:1224
                                                                • C:\Program Files\Google\backup.exe
                                                                  "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                  5⤵
                                                                    PID:2956
                                                                    • C:\Program Files\Google\Chrome\backup.exe
                                                                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                      6⤵
                                                                      • System policy modification
                                                                      PID:4860
                                                                      • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                        7⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:3040
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                          8⤵
                                                                          • Drops file in Program Files directory
                                                                          PID:2976
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System policy modification
                                                                            PID:5000
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:2620
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                            9⤵
                                                                              PID:5044
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\update.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                              9⤵
                                                                              • System policy modification
                                                                              PID:1444
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                              9⤵
                                                                                PID:3552
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                9⤵
                                                                                • Disables RegEdit via registry modification
                                                                                PID:4732
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                9⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:4456
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                9⤵
                                                                                  PID:1460
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                    10⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:2272
                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                      11⤵
                                                                                        PID:620
                                                                                • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                  8⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  PID:3828
                                                                          • C:\Program Files\Internet Explorer\backup.exe
                                                                            "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                            5⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Drops file in Program Files directory
                                                                            PID:3832
                                                                            • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                              "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                              6⤵
                                                                                PID:3692
                                                                              • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                6⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System policy modification
                                                                                PID:4512
                                                                              • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                6⤵
                                                                                • Disables RegEdit via registry modification
                                                                                PID:744
                                                                              • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                6⤵
                                                                                • System policy modification
                                                                                PID:1420
                                                                              • C:\Program Files\Internet Explorer\images\data.exe
                                                                                "C:\Program Files\Internet Explorer\images\data.exe" C:\Program Files\Internet Explorer\images\
                                                                                6⤵
                                                                                  PID:5052
                                                                                • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                  6⤵
                                                                                    PID:392
                                                                                  • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                    "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:1080
                                                                                  • C:\Program Files\Internet Explorer\SIGNUP\System Restore.exe
                                                                                    "C:\Program Files\Internet Explorer\SIGNUP\System Restore.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                    6⤵
                                                                                      PID:1448
                                                                                  • C:\Program Files\Java\backup.exe
                                                                                    "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                    5⤵
                                                                                      PID:1488
                                                                                      • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                                        "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                        6⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Drops file in Program Files directory
                                                                                        PID:2712
                                                                                        • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                          "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                          7⤵
                                                                                            PID:2312
                                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\System Restore.exe
                                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                            7⤵
                                                                                            • Drops file in Program Files directory
                                                                                            • System policy modification
                                                                                            PID:1592
                                                                                            • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                              "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                              8⤵
                                                                                                PID:3084
                                                                                              • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                                "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                8⤵
                                                                                                • System policy modification
                                                                                                PID:712
                                                                                            • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                              "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                              7⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:400
                                                                                              • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                8⤵
                                                                                                  PID:3548
                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                    9⤵
                                                                                                      PID:4164
                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                  7⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:2620
                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                    8⤵
                                                                                                      PID:2960
                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                        9⤵
                                                                                                          PID:3272
                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe
                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                                          9⤵
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          PID:5000
                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                                          9⤵
                                                                                                            PID:752
                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                                          8⤵
                                                                                                          • Drops file in Program Files directory
                                                                                                          PID:4372
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\update.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\update.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\
                                                                                                            9⤵
                                                                                                              PID:4880
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\
                                                                                                              9⤵
                                                                                                                PID:3560
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                                                            7⤵
                                                                                                              PID:3660
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\System Restore.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\
                                                                                                                8⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:2600
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\
                                                                                                                  9⤵
                                                                                                                  • System policy modification
                                                                                                                  PID:3700
                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\
                                                                                                                    10⤵
                                                                                                                    • System policy modification
                                                                                                                    PID:2088
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\
                                                                                                                  9⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  PID:2012
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\
                                                                                                                  9⤵
                                                                                                                    PID:4832
                                                                                                            • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                                              "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                              6⤵
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:4904
                                                                                                              • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                                                "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                                7⤵
                                                                                                                  PID:3172
                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                    8⤵
                                                                                                                      PID:1508
                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                      8⤵
                                                                                                                        PID:1884
                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                        8⤵
                                                                                                                          PID:924
                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\lib\backup.exe
                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\lib\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\
                                                                                                                        7⤵
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        PID:2176
                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\lib\amd64\update.exe
                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\lib\amd64\update.exe" C:\Program Files\Java\jre1.8.0_66\lib\amd64\
                                                                                                                          8⤵
                                                                                                                            PID:4384
                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe
                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\applet\
                                                                                                                            8⤵
                                                                                                                              PID:3152
                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe
                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\cmm\
                                                                                                                              8⤵
                                                                                                                                PID:3884
                                                                                                                        • C:\Program Files\Microsoft Office\data.exe
                                                                                                                          "C:\Program Files\Microsoft Office\data.exe" C:\Program Files\Microsoft Office\
                                                                                                                          5⤵
                                                                                                                            PID:5008
                                                                                                                            • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                                              "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                              6⤵
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              PID:5048
                                                                                                                            • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                                              "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                              6⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:2320
                                                                                                                            • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                                                              "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                              6⤵
                                                                                                                                PID:4876
                                                                                                                                • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                                                                  "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                                                  7⤵
                                                                                                                                    PID:4648
                                                                                                                                  • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                                                    "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                                                    7⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    PID:2760
                                                                                                                                    • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                                                                      "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                                      8⤵
                                                                                                                                        PID:4976
                                                                                                                                      • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                                                                                        "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                                                                                        8⤵
                                                                                                                                          PID:112
                                                                                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
                                                                                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
                                                                                                                                          8⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          PID:1916
                                                                                                                                      • C:\Program Files\Microsoft Office\root\fre\update.exe
                                                                                                                                        "C:\Program Files\Microsoft Office\root\fre\update.exe" C:\Program Files\Microsoft Office\root\fre\
                                                                                                                                        7⤵
                                                                                                                                          PID:712
                                                                                                                                    • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                                                      "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                                                      5⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      PID:740
                                                                                                                                      • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                                                                                        "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                                                                        6⤵
                                                                                                                                          PID:4224
                                                                                                                                      • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                                                        5⤵
                                                                                                                                        • System policy modification
                                                                                                                                        PID:4056
                                                                                                                                        • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                                                                                                          "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                                                                                                          6⤵
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:1524
                                                                                                                                          • C:\Program Files\Mozilla Firefox\browser\features\backup.exe
                                                                                                                                            "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
                                                                                                                                            7⤵
                                                                                                                                              PID:880
                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
                                                                                                                                              "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
                                                                                                                                              7⤵
                                                                                                                                                PID:1216
                                                                                                                                            • C:\Program Files\Mozilla Firefox\defaults\System Restore.exe
                                                                                                                                              "C:\Program Files\Mozilla Firefox\defaults\System Restore.exe" C:\Program Files\Mozilla Firefox\defaults\
                                                                                                                                              6⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              PID:1892
                                                                                                                                              • C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
                                                                                                                                                "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
                                                                                                                                                7⤵
                                                                                                                                                  PID:4992
                                                                                                                                              • C:\Program Files\Mozilla Firefox\fonts\backup.exe
                                                                                                                                                "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
                                                                                                                                                6⤵
                                                                                                                                                  PID:3956
                                                                                                                                            • C:\Program Files (x86)\backup.exe
                                                                                                                                              "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                                              4⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              PID:1564
                                                                                                                                              • C:\Program Files (x86)\Adobe\update.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\
                                                                                                                                                5⤵
                                                                                                                                                  PID:4404
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                                                    6⤵
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:4896
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                                                      7⤵
                                                                                                                                                        PID:3972
                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                                                        7⤵
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        PID:2084
                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                                          8⤵
                                                                                                                                                            PID:392
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                                              9⤵
                                                                                                                                                                PID:1216
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                                              8⤵
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:3660
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                                                9⤵
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:2148
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                                              8⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:628
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                                              8⤵
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:4612
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                                              8⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:1964
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                                                9⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:2564
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                                              8⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:1556
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                                                9⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:3668
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                                              8⤵
                                                                                                                                                                PID:3120
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:3756
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:2796
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                                                    8⤵
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:3624
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                      PID:4408
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                                                    8⤵
                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                    PID:2780
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                      • System policy modification
                                                                                                                                                                      PID:3660
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                                        10⤵
                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                        • System policy modification
                                                                                                                                                                        PID:1704
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      PID:936
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                                        10⤵
                                                                                                                                                                          PID:2460
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                                            11⤵
                                                                                                                                                                              PID:1700
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                                                                                                          9⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          PID:4796
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                                                            10⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            PID:1840
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                                                                                                          9⤵
                                                                                                                                                                          • System policy modification
                                                                                                                                                                          PID:4468
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                                                        8⤵
                                                                                                                                                                        • System policy modification
                                                                                                                                                                        PID:4640
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                                                                          9⤵
                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                          • System policy modification
                                                                                                                                                                          PID:4984
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                                                                        8⤵
                                                                                                                                                                        • System policy modification
                                                                                                                                                                        PID:3100
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                                                                        8⤵
                                                                                                                                                                        • System policy modification
                                                                                                                                                                        PID:2012
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                                                                                                        8⤵
                                                                                                                                                                        • System policy modification
                                                                                                                                                                        PID:4148
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:1000
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
                                                                                                                                                                              10⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              PID:1308
                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
                                                                                                                                                                                11⤵
                                                                                                                                                                                  PID:832
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
                                                                                                                                                                                    12⤵
                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                    PID:4744
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\
                                                                                                                                                                                      13⤵
                                                                                                                                                                                        PID:4524
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                            PID:4236
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                                              8⤵
                                                                                                                                                                              • System policy modification
                                                                                                                                                                              PID:988
                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                                                9⤵
                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                PID:1916
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\update.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:696
                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                                                8⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                • System policy modification
                                                                                                                                                                                PID:4744
                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                                  9⤵
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  PID:1664
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                                    10⤵
                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                    PID:4888
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                                    10⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    PID:2572
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                                                      11⤵
                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                      PID:3984
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                                                      11⤵
                                                                                                                                                                                        PID:2468
                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                                                        11⤵
                                                                                                                                                                                          PID:2268
                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:3756
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:1600
                                                                                                                                                                                • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  PID:4024
                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                    PID:4040
                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                                      7⤵
                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                      PID:3276
                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:2956
                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                                                          8⤵
                                                                                                                                                                                            PID:4920
                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:1372
                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                                            8⤵
                                                                                                                                                                                              PID:408
                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\System Restore.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:4740
                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                      PID:3464
                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                          PID:3084
                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          PID:3092
                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            PID:3304
                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            PID:3548
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                PID:4760
                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:2268
                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                      PID:1392
                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:4456
                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:3088
                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                PID:392
                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                PID:4288
                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:1592
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:4832
                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\System\ado\System Restore.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\System\ado\System Restore.exe" C:\Program Files (x86)\Common Files\System\ado\
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  PID:4092
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:396
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                      PID:2284
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                        PID:1616
                                                                                                                                                                                                                • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  PID:3408
                                                                                                                                                                                                                  • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:1796
                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                      PID:3528
                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Temp\System Restore.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Temp\System Restore.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                      PID:1276
                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                      PID:4512
                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                        PID:2684
                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:4660
                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                              • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                        • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\de-DE\System Restore.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\de-DE\System Restore.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                            PID:5032
                                                                                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:3456
                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                              PID:2524
                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:4028
                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\images\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                PID:3160
                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:740
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                PID:2332
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\backup.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:3636
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                      PID:1420
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                          PID:1372
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                              PID:1572
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                  PID:5092
                                                                                                                                                                                                                                    • C:\Users\backup.exe
                                                                                                                                                                                                                                      C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:2908
                                                                                                                                                                                                                                        • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                                          C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                          PID:2980
                                                                                                                                                                                                                                          • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:1960
                                                                                                                                                                                                                                            • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                                                                                              C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:3980
                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                PID:4996
                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                                                                C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                PID:4988
                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                                                                C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:1216
                                                                                                                                                                                                                                                • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                                                  • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                                                    • C:\Users\Admin\Music\data.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\Music\data.exe C:\Users\Admin\Music\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:208
                                                                                                                                                                                                                                                      • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                        PID:4652
                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:2576
                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:1428
                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Saved Pictures\data.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Saved Pictures\data.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                            • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:4524
                                                                                                                                                                                                                                                              • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                PID:2164
                                                                                                                                                                                                                                                              • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                              • C:\Users\Public\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                PID:3980
                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                  PID:3160
                                                                                                                                                                                                                                                                • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:4160
                                                                                                                                                                                                                                                                  • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                                                                                    C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                    • C:\Users\Public\Pictures\System Restore.exe
                                                                                                                                                                                                                                                                      "C:\Users\Public\Pictures\System Restore.exe" C:\Users\Public\Pictures\
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                      PID:3608
                                                                                                                                                                                                                                                                    • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:372
                                                                                                                                                                                                                                                                  • C:\Windows\System Restore.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System Restore.exe" C:\Windows\
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:4400
                                                                                                                                                                                                                                                                    • C:\Windows\addins\backup.exe
                                                                                                                                                                                                                                                                      C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                      PID:4052
                                                                                                                                                                                                                                                                    • C:\Windows\appcompat\backup.exe
                                                                                                                                                                                                                                                                      C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                                                      • C:\Windows\appcompat\appraiser\System Restore.exe
                                                                                                                                                                                                                                                                        "C:\Windows\appcompat\appraiser\System Restore.exe" C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:512
                                                                                                                                                                                                                                                                        • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                                                                                                          C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                                                                                        • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                                                                                          C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                          PID:1444
                                                                                                                                                                                                                                                                        • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                                                                                          C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                          PID:3356
                                                                                                                                                                                                                                                                      • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                                                                                                        C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:116
                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                                                                                                                                                          C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:1520
                                                                                                                                                                                                                                                                          • C:\Windows\apppatch\Custom\update.exe
                                                                                                                                                                                                                                                                            C:\Windows\apppatch\Custom\update.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:3908
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                      PID:1476
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                      PID:5068
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                      PID:4928
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                      PID:732
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                      PID:4232
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                      PID:1068
                                                                                                                                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:1684

                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                    • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      542a82963f9b9f25d58dcb3135e9551a

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ca28a0c756bd52909abf832e377f9def250e2c42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      9e9369d6ffa41ceebbe6ace2b5c1c984bd20705cd56c18ca9760022effddc4c7

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      d9f2cf1cca6bb533accafe6ecd733cf2c901cd9c98da27a976578e03aa72a369d828eba1781a8879ab0880c9c33e880632fe069d54d350c79c4e36692ecb133a

                                                                                                                                                                                                                                                                    • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      542a82963f9b9f25d58dcb3135e9551a

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ca28a0c756bd52909abf832e377f9def250e2c42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      9e9369d6ffa41ceebbe6ace2b5c1c984bd20705cd56c18ca9760022effddc4c7

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      d9f2cf1cca6bb533accafe6ecd733cf2c901cd9c98da27a976578e03aa72a369d828eba1781a8879ab0880c9c33e880632fe069d54d350c79c4e36692ecb133a

                                                                                                                                                                                                                                                                    • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      36ff6646800b8bf313f298e8b72929eb

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6d612316ae19e1d439aa7edd18912e7a0a293c60

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      6ac31e4d87d99447f50925506eeb5be337dbbe169aa40999af2dad35631ace86

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      a48b45d8466fb11b2d4b12450cc71fd5fab6ecceca212579ece907f3bbf504ddee52960dd1e83bb69b993a38dca1bb976f42f669dadaa650ae1d1f2da1956dfc

                                                                                                                                                                                                                                                                    • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      36ff6646800b8bf313f298e8b72929eb

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6d612316ae19e1d439aa7edd18912e7a0a293c60

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      6ac31e4d87d99447f50925506eeb5be337dbbe169aa40999af2dad35631ace86

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      a48b45d8466fb11b2d4b12450cc71fd5fab6ecceca212579ece907f3bbf504ddee52960dd1e83bb69b993a38dca1bb976f42f669dadaa650ae1d1f2da1956dfc

                                                                                                                                                                                                                                                                    • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      532024baa83829a50f753100793956b0

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      fcef1b4329e9dc9aa29cf02e0ae3ac657af78d9b

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      35680da81c08b1ea016c2d3b24fcd0a63fd6a65082e5694b18b39af2f27a259b

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      a79d18f2a2b758751bf7af9911cee04ee3dfce4fb9b6bdc35a2c9986ebca97350822b6c1750b182ded201834601c8ef4a060add8a8b1ddfb20f2164396473b88

                                                                                                                                                                                                                                                                    • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      532024baa83829a50f753100793956b0

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      fcef1b4329e9dc9aa29cf02e0ae3ac657af78d9b

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      35680da81c08b1ea016c2d3b24fcd0a63fd6a65082e5694b18b39af2f27a259b

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      a79d18f2a2b758751bf7af9911cee04ee3dfce4fb9b6bdc35a2c9986ebca97350822b6c1750b182ded201834601c8ef4a060add8a8b1ddfb20f2164396473b88

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      353fee9e300b997823ae6399b5dcf81c

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      02d622e9ed6de521e8eee1b64acd990e58650bcc

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      471bed4b38a51214c2aeb4ee0d7e5f8d9ce35d34a4803360b64b8cab31e0b3ed

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      8ad4b5b63d4bb5fb319ee051c2556e3c6aa461ade8418470aa42adfee31bf5a68f48edcbcead3006911d6fa20587f29478c3bbbafad32038baa1ff15831e1197

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      353fee9e300b997823ae6399b5dcf81c

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      02d622e9ed6de521e8eee1b64acd990e58650bcc

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      471bed4b38a51214c2aeb4ee0d7e5f8d9ce35d34a4803360b64b8cab31e0b3ed

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      8ad4b5b63d4bb5fb319ee051c2556e3c6aa461ade8418470aa42adfee31bf5a68f48edcbcead3006911d6fa20587f29478c3bbbafad32038baa1ff15831e1197

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      bffc787427f3ee24734b8b8393156c9c

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ab2f3d9a2d18c55ad5d0c0ba855748274499d2ae

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      e034c884a91bd97298e0f250420a5890b812aad09b370380cbcb587e42f4e488

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      98344b156d8c945b87586a76a8fafbd92945200952122852384331f172f5ee589c40ef30794a75debb80605b10ca600cc599eb401a7360472673055417b5b39f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      bffc787427f3ee24734b8b8393156c9c

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ab2f3d9a2d18c55ad5d0c0ba855748274499d2ae

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      e034c884a91bd97298e0f250420a5890b812aad09b370380cbcb587e42f4e488

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      98344b156d8c945b87586a76a8fafbd92945200952122852384331f172f5ee589c40ef30794a75debb80605b10ca600cc599eb401a7360472673055417b5b39f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      353fee9e300b997823ae6399b5dcf81c

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      02d622e9ed6de521e8eee1b64acd990e58650bcc

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      471bed4b38a51214c2aeb4ee0d7e5f8d9ce35d34a4803360b64b8cab31e0b3ed

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      8ad4b5b63d4bb5fb319ee051c2556e3c6aa461ade8418470aa42adfee31bf5a68f48edcbcead3006911d6fa20587f29478c3bbbafad32038baa1ff15831e1197

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      353fee9e300b997823ae6399b5dcf81c

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      02d622e9ed6de521e8eee1b64acd990e58650bcc

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      471bed4b38a51214c2aeb4ee0d7e5f8d9ce35d34a4803360b64b8cab31e0b3ed

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      8ad4b5b63d4bb5fb319ee051c2556e3c6aa461ade8418470aa42adfee31bf5a68f48edcbcead3006911d6fa20587f29478c3bbbafad32038baa1ff15831e1197

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      73cb9b16c14daa63f152470bf580aae1

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      65708b0dfe84541f24943f02bd527136974b8980

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      13a6dcec72cee7c6db8d7296ae1aaf8db6466795f5c20a3291855f9b18b668f3

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      3cfd9d214532a1ea00e859e7838a6db7a59ac4845516ec29898abcd2b5cf0151237cd90fd28dce9d0b9a032cdfcac9c8d95b39dc981c6ecb6b910d94147c6caa

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      73cb9b16c14daa63f152470bf580aae1

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      65708b0dfe84541f24943f02bd527136974b8980

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      13a6dcec72cee7c6db8d7296ae1aaf8db6466795f5c20a3291855f9b18b668f3

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      3cfd9d214532a1ea00e859e7838a6db7a59ac4845516ec29898abcd2b5cf0151237cd90fd28dce9d0b9a032cdfcac9c8d95b39dc981c6ecb6b910d94147c6caa

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      73cb9b16c14daa63f152470bf580aae1

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      65708b0dfe84541f24943f02bd527136974b8980

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      13a6dcec72cee7c6db8d7296ae1aaf8db6466795f5c20a3291855f9b18b668f3

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      3cfd9d214532a1ea00e859e7838a6db7a59ac4845516ec29898abcd2b5cf0151237cd90fd28dce9d0b9a032cdfcac9c8d95b39dc981c6ecb6b910d94147c6caa

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      73cb9b16c14daa63f152470bf580aae1

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      65708b0dfe84541f24943f02bd527136974b8980

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      13a6dcec72cee7c6db8d7296ae1aaf8db6466795f5c20a3291855f9b18b668f3

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      3cfd9d214532a1ea00e859e7838a6db7a59ac4845516ec29898abcd2b5cf0151237cd90fd28dce9d0b9a032cdfcac9c8d95b39dc981c6ecb6b910d94147c6caa

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\da-DK\update.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\da-DK\update.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d98b320eb7877c0de4e6fae3fdab1122

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eb75f62f210f943aa332ebe477a64c8c94c87f42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f241e79e4466d17a4e5eada97bec5579cfaf90eb1755ebe3b342467a69518fac

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      df7e0c67bcbc363d28cadf8da3b451e0644b2cede69b5c6270cead3aa692f697557f4c999d124d8c56f3cc2ea32bf554948120865beae31a4167352214741250

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b5f7902159f0938e01070c8e9045f369

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      88b6e04f50947035d17c693e044a4c21592c2d16

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      09c6f059720e4ea033afebb43c44ecfa4310c94ede7921bd67beb3c8d750e0ee

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      049d79ebe3be1849d917b871d09298a54f81bd60ff93b6a6b67939b36199e8f2e43c92057af2ed0b52a95b632f23e9ce11ad6b0e083de245434f016feb89146f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\update.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      bffc787427f3ee24734b8b8393156c9c

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ab2f3d9a2d18c55ad5d0c0ba855748274499d2ae

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      e034c884a91bd97298e0f250420a5890b812aad09b370380cbcb587e42f4e488

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      98344b156d8c945b87586a76a8fafbd92945200952122852384331f172f5ee589c40ef30794a75debb80605b10ca600cc599eb401a7360472673055417b5b39f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\ink\update.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      bffc787427f3ee24734b8b8393156c9c

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ab2f3d9a2d18c55ad5d0c0ba855748274499d2ae

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      e034c884a91bd97298e0f250420a5890b812aad09b370380cbcb587e42f4e488

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      98344b156d8c945b87586a76a8fafbd92945200952122852384331f172f5ee589c40ef30794a75debb80605b10ca600cc599eb401a7360472673055417b5b39f

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\update.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      1f54a28a006a477ddb3e37ac4a72f429

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      3faa8d2e1efca9a04fd53e574759544d82797c55

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      cdf533e3cad4c8fc1c676a6ce1cd08e470cd6ab433f0b394624c96cf9853ac62

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ffca225f5bc7d900feac0e75d8350b74e5b833aae8dcf5a4c01be588513bbd17322684ad015739fbae391b9a052537421eb0cf1cd009b212721964ac6a3ba8d6

                                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\update.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      1f54a28a006a477ddb3e37ac4a72f429

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      3faa8d2e1efca9a04fd53e574759544d82797c55

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      cdf533e3cad4c8fc1c676a6ce1cd08e470cd6ab433f0b394624c96cf9853ac62

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ffca225f5bc7d900feac0e75d8350b74e5b833aae8dcf5a4c01be588513bbd17322684ad015739fbae391b9a052537421eb0cf1cd009b212721964ac6a3ba8d6

                                                                                                                                                                                                                                                                    • C:\Program Files\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      542a82963f9b9f25d58dcb3135e9551a

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ca28a0c756bd52909abf832e377f9def250e2c42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      9e9369d6ffa41ceebbe6ace2b5c1c984bd20705cd56c18ca9760022effddc4c7

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      d9f2cf1cca6bb533accafe6ecd733cf2c901cd9c98da27a976578e03aa72a369d828eba1781a8879ab0880c9c33e880632fe069d54d350c79c4e36692ecb133a

                                                                                                                                                                                                                                                                    • C:\Program Files\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      542a82963f9b9f25d58dcb3135e9551a

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      ca28a0c756bd52909abf832e377f9def250e2c42

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      9e9369d6ffa41ceebbe6ace2b5c1c984bd20705cd56c18ca9760022effddc4c7

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      d9f2cf1cca6bb533accafe6ecd733cf2c901cd9c98da27a976578e03aa72a369d828eba1781a8879ab0880c9c33e880632fe069d54d350c79c4e36692ecb133a

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3706937728\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e998b3775e8a0aae89892a59a350b911

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      b1fc7f42e7dd9c2993f322f2702353f50266e25a

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      34c62d2c2caae1051e538331e7e0730ddb21fd675b57de36686d8c3fc0d92c16

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ab77f50746c6607ceaef11ad369f46daa733257fd45bad28bb74b143656f6b17dccd6e60cf0c3b6cf7891c044ab60f95008dc5abd7177ffc2f7b5c0f6c8c562b

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3706937728\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e998b3775e8a0aae89892a59a350b911

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      b1fc7f42e7dd9c2993f322f2702353f50266e25a

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      34c62d2c2caae1051e538331e7e0730ddb21fd675b57de36686d8c3fc0d92c16

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ab77f50746c6607ceaef11ad369f46daa733257fd45bad28bb74b143656f6b17dccd6e60cf0c3b6cf7891c044ab60f95008dc5abd7177ffc2f7b5c0f6c8c562b

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e13c3db4c0285ac1c08936178aac924b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ab1174e858c82e721702b63b9f3f16487cbe4d8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      bad14be004fac05bf6ca8ddb564f1ff9d9e27642e5dc6ac366194752f941e0c4

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      042a18422296837285c32925ed30c9833da4bd7b3784c4096b81f9f49eb7d282fe2e8ecba0d5f97994ce538e48411279ec5623bc772c5f56ee7971f360c0ffe3

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e13c3db4c0285ac1c08936178aac924b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ab1174e858c82e721702b63b9f3f16487cbe4d8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      bad14be004fac05bf6ca8ddb564f1ff9d9e27642e5dc6ac366194752f941e0c4

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      042a18422296837285c32925ed30c9833da4bd7b3784c4096b81f9f49eb7d282fe2e8ecba0d5f97994ce538e48411279ec5623bc772c5f56ee7971f360c0ffe3

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e13c3db4c0285ac1c08936178aac924b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ab1174e858c82e721702b63b9f3f16487cbe4d8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      bad14be004fac05bf6ca8ddb564f1ff9d9e27642e5dc6ac366194752f941e0c4

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      042a18422296837285c32925ed30c9833da4bd7b3784c4096b81f9f49eb7d282fe2e8ecba0d5f97994ce538e48411279ec5623bc772c5f56ee7971f360c0ffe3

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e13c3db4c0285ac1c08936178aac924b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ab1174e858c82e721702b63b9f3f16487cbe4d8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      bad14be004fac05bf6ca8ddb564f1ff9d9e27642e5dc6ac366194752f941e0c4

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      042a18422296837285c32925ed30c9833da4bd7b3784c4096b81f9f49eb7d282fe2e8ecba0d5f97994ce538e48411279ec5623bc772c5f56ee7971f360c0ffe3

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e13c3db4c0285ac1c08936178aac924b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ab1174e858c82e721702b63b9f3f16487cbe4d8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      bad14be004fac05bf6ca8ddb564f1ff9d9e27642e5dc6ac366194752f941e0c4

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      042a18422296837285c32925ed30c9833da4bd7b3784c4096b81f9f49eb7d282fe2e8ecba0d5f97994ce538e48411279ec5623bc772c5f56ee7971f360c0ffe3

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e13c3db4c0285ac1c08936178aac924b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ab1174e858c82e721702b63b9f3f16487cbe4d8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      bad14be004fac05bf6ca8ddb564f1ff9d9e27642e5dc6ac366194752f941e0c4

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      042a18422296837285c32925ed30c9833da4bd7b3784c4096b81f9f49eb7d282fe2e8ecba0d5f97994ce538e48411279ec5623bc772c5f56ee7971f360c0ffe3

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e998b3775e8a0aae89892a59a350b911

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      b1fc7f42e7dd9c2993f322f2702353f50266e25a

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      34c62d2c2caae1051e538331e7e0730ddb21fd675b57de36686d8c3fc0d92c16

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ab77f50746c6607ceaef11ad369f46daa733257fd45bad28bb74b143656f6b17dccd6e60cf0c3b6cf7891c044ab60f95008dc5abd7177ffc2f7b5c0f6c8c562b

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e998b3775e8a0aae89892a59a350b911

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      b1fc7f42e7dd9c2993f322f2702353f50266e25a

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      34c62d2c2caae1051e538331e7e0730ddb21fd675b57de36686d8c3fc0d92c16

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ab77f50746c6607ceaef11ad369f46daa733257fd45bad28bb74b143656f6b17dccd6e60cf0c3b6cf7891c044ab60f95008dc5abd7177ffc2f7b5c0f6c8c562b

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e998b3775e8a0aae89892a59a350b911

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      b1fc7f42e7dd9c2993f322f2702353f50266e25a

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      34c62d2c2caae1051e538331e7e0730ddb21fd675b57de36686d8c3fc0d92c16

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ab77f50746c6607ceaef11ad369f46daa733257fd45bad28bb74b143656f6b17dccd6e60cf0c3b6cf7891c044ab60f95008dc5abd7177ffc2f7b5c0f6c8c562b

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e998b3775e8a0aae89892a59a350b911

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      b1fc7f42e7dd9c2993f322f2702353f50266e25a

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      34c62d2c2caae1051e538331e7e0730ddb21fd675b57de36686d8c3fc0d92c16

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ab77f50746c6607ceaef11ad369f46daa733257fd45bad28bb74b143656f6b17dccd6e60cf0c3b6cf7891c044ab60f95008dc5abd7177ffc2f7b5c0f6c8c562b

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e13c3db4c0285ac1c08936178aac924b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ab1174e858c82e721702b63b9f3f16487cbe4d8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      bad14be004fac05bf6ca8ddb564f1ff9d9e27642e5dc6ac366194752f941e0c4

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      042a18422296837285c32925ed30c9833da4bd7b3784c4096b81f9f49eb7d282fe2e8ecba0d5f97994ce538e48411279ec5623bc772c5f56ee7971f360c0ffe3

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      e13c3db4c0285ac1c08936178aac924b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ab1174e858c82e721702b63b9f3f16487cbe4d8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      bad14be004fac05bf6ca8ddb564f1ff9d9e27642e5dc6ac366194752f941e0c4

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      042a18422296837285c32925ed30c9833da4bd7b3784c4096b81f9f49eb7d282fe2e8ecba0d5f97994ce538e48411279ec5623bc772c5f56ee7971f360c0ffe3

                                                                                                                                                                                                                                                                    • C:\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      ab0d0cc0620968a9d5a9d75a92e3eceb

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      e62893b0e5e7c42350521263ac0a4e3d98d92ded

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      e255146287857d62c6ed43a4717a38ef79e0bf6d08b5a85e6f29389cbcf2b6a0

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      2150a647f8a993433373924f02dc493b9cc069042679a05a10792543edc4085c2fee7a4b394a9844e41bba2f0e730569bc4f60c12ab94a2934d248bebd50b1b4

                                                                                                                                                                                                                                                                    • C:\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      ab0d0cc0620968a9d5a9d75a92e3eceb

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      e62893b0e5e7c42350521263ac0a4e3d98d92ded

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      e255146287857d62c6ed43a4717a38ef79e0bf6d08b5a85e6f29389cbcf2b6a0

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      2150a647f8a993433373924f02dc493b9cc069042679a05a10792543edc4085c2fee7a4b394a9844e41bba2f0e730569bc4f60c12ab94a2934d248bebd50b1b4

                                                                                                                                                                                                                                                                    • C:\odt\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b19029db5c0348c3a94f86829e81563e

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      3082a35b8437fcb4ffe1e00d7550f7d3bc158609

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      8c2331faeac0f6ace8ca0a38a1cade7266d76f1a4d24e44281fb0f8f4aebc81c

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      b9de29bed841854574cc780322b9652af10d8eff0633fd716219ae8ab803de16b1f2f7546db2bd72fde59146a4363c14df9b8abeebdf6c5a145fdf089c81c98a

                                                                                                                                                                                                                                                                    • C:\odt\backup.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b19029db5c0348c3a94f86829e81563e

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      3082a35b8437fcb4ffe1e00d7550f7d3bc158609

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      8c2331faeac0f6ace8ca0a38a1cade7266d76f1a4d24e44281fb0f8f4aebc81c

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      b9de29bed841854574cc780322b9652af10d8eff0633fd716219ae8ab803de16b1f2f7546db2bd72fde59146a4363c14df9b8abeebdf6c5a145fdf089c81c98a