Overview

overview

10

Static

static

047b63387f...7d.exe

windows7-x64

10

047b63387f...7d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-10-2022 06:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    047b63387f274cc7ef9aba5216a201d7a3ebe7b1044112ae44644be65da87a7d.exe

  • Size

    72KB

  • MD5

    00e10cc6681a971ecd92c412a8573390

  • SHA1

    1c75f106a657ab1e248025a01218c75dd46e392d

  • SHA256

    047b63387f274cc7ef9aba5216a201d7a3ebe7b1044112ae44644be65da87a7d

  • SHA512

    7aa8f3571c6b875c3707b5450de5b29f0d01e8c771f7b62c0f318440eecc2ce5b2ade36710df888ec4503a147853fd00739afc8af1c4f2e6ce21a777f87a2cce

  • SSDEEP

    768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd3FAyv2:HeT7BVwxfvqguKRFAD

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\047b63387f274cc7ef9aba5216a201d7a3ebe7b1044112ae44644be65da87a7d.exe
    "C:\Users\Admin\AppData\Local\Temp\047b63387f274cc7ef9aba5216a201d7a3ebe7b1044112ae44644be65da87a7d.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3372
    • C:\Users\Admin\AppData\Local\Temp\539485856\backup.exe
      C:\Users\Admin\AppData\Local\Temp\539485856\backup.exe C:\Users\Admin\AppData\Local\Temp\539485856\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1320
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1316
        • C:\Program Files\data.exe
          "C:\Program Files\data.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3244
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2148
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2264
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1672
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:5032
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3032
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4576
              • C:\Program Files\Common Files\microsoft shared\ink\update.exe
                "C:\Program Files\Common Files\microsoft shared\ink\update.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3864
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3860
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2664
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4780
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5100
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4456
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1952
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1308
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3880
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2784
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4368
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:312
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4840
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1864
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2660
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4232
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4552
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2544
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2384
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2116
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3360
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3888
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2388
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3396
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4328
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4992
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2348
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3968
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4128
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4812
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:8
                • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4748
                • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4688
                • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4648
                • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2592
                • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4664
                • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4788
                • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\data.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4100
                • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4568
                • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2112
                • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1324
                • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1660
                • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\data.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4796
                • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2256
                • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:216
                • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                  8⤵
                  • System policy modification
                  PID:3488
                • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                  8⤵
                    PID:3984
                  • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                    8⤵
                    • System policy modification
                    PID:3108
                  • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                    8⤵
                    • System policy modification
                    PID:4264
                  • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                    8⤵
                      PID:1528
                    • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                      8⤵
                      • System policy modification
                      PID:1164
                    • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                      8⤵
                      • System policy modification
                      PID:2360
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    PID:3848
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                      8⤵
                      • System policy modification
                      PID:4876
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                      8⤵
                        PID:3796
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                        8⤵
                          PID:1900
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                          8⤵
                            PID:4232
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                            8⤵
                              PID:1428
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                              8⤵
                              • System policy modification
                              PID:1664
                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                            7⤵
                            • Drops file in Program Files directory
                            PID:3112
                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                              8⤵
                                PID:5096
                            • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                              7⤵
                                PID:4552
                              • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                7⤵
                                • System policy modification
                                PID:2416
                              • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                7⤵
                                  PID:4812
                                • C:\Program Files\Common Files\microsoft shared\TextConv\System Restore.exe
                                  "C:\Program Files\Common Files\microsoft shared\TextConv\System Restore.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Drops file in Program Files directory
                                  • System policy modification
                                  PID:1512
                                  • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\update.exe
                                    "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\update.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                    8⤵
                                      PID:2148
                                  • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:3660
                                    • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:4072
                                  • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                    7⤵
                                    • System policy modification
                                    PID:4968
                                  • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                    7⤵
                                      PID:5116
                                    • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:4220
                                      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                        8⤵
                                        • System policy modification
                                        PID:4704
                                        • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                          9⤵
                                            PID:3412
                                    • C:\Program Files\Common Files\Services\backup.exe
                                      "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      PID:936
                                    • C:\Program Files\Common Files\System\backup.exe
                                      "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                      6⤵
                                      • Drops file in Program Files directory
                                      PID:4472
                                      • C:\Program Files\Common Files\System\ado\backup.exe
                                        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                        7⤵
                                        • Drops file in Program Files directory
                                        PID:2488
                                        • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                          "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          PID:2508
                                        • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                          "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                          8⤵
                                            PID:3040
                                          • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                            "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:4256
                                          • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                            "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                            8⤵
                                            • System policy modification
                                            PID:1432
                                          • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                            "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                            8⤵
                                              PID:4100
                                            • C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe
                                              "C:\Program Files\Common Files\System\ado\ja-JP\System Restore.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:4180
                                          • C:\Program Files\Common Files\System\de-DE\backup.exe
                                            "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                            7⤵
                                              PID:4184
                                            • C:\Program Files\Common Files\System\en-US\backup.exe
                                              "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                              7⤵
                                                PID:3476
                                              • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                7⤵
                                                  PID:4876
                                                • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                  "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                  7⤵
                                                    PID:3796
                                                  • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                    "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                    7⤵
                                                      PID:4384
                                                    • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                      "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                      7⤵
                                                        PID:4748
                                                      • C:\Program Files\Common Files\System\msadc\backup.exe
                                                        "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                        7⤵
                                                        • Drops file in Program Files directory
                                                        PID:4640
                                                        • C:\Program Files\Common Files\System\msadc\de-DE\data.exe
                                                          "C:\Program Files\Common Files\System\msadc\de-DE\data.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                          8⤵
                                                            PID:1440
                                                          • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                            "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                            8⤵
                                                            • System policy modification
                                                            PID:1160
                                                          • C:\Program Files\Common Files\System\msadc\es-ES\update.exe
                                                            "C:\Program Files\Common Files\System\msadc\es-ES\update.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                            8⤵
                                                              PID:616
                                                            • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                              "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:3236
                                                            • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                              "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                              8⤵
                                                                PID:4552
                                                              • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                8⤵
                                                                  PID:4880
                                                              • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                7⤵
                                                                  PID:1904
                                                                  • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                    "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                    8⤵
                                                                      PID:668
                                                                    • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                      "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                      8⤵
                                                                        PID:3108
                                                                      • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                        "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                        8⤵
                                                                          PID:4868
                                                                        • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                          "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                          8⤵
                                                                            PID:4684
                                                                          • C:\Program Files\Common Files\System\Ole DB\it-IT\System Restore.exe
                                                                            "C:\Program Files\Common Files\System\Ole DB\it-IT\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:2040
                                                                          • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                            "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                            8⤵
                                                                              PID:1924
                                                                      • C:\Program Files\Google\backup.exe
                                                                        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                        5⤵
                                                                        • Drops file in Program Files directory
                                                                        PID:3644
                                                                        • C:\Program Files\Google\Chrome\backup.exe
                                                                          "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                          6⤵
                                                                          • Drops file in Program Files directory
                                                                          • System policy modification
                                                                          PID:3804
                                                                          • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                            7⤵
                                                                            • System policy modification
                                                                            PID:3832
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                              8⤵
                                                                              • Drops file in Program Files directory
                                                                              PID:1748
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                9⤵
                                                                                • System policy modification
                                                                                PID:4128
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                9⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:548
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                9⤵
                                                                                • System policy modification
                                                                                PID:1324
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                9⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System policy modification
                                                                                PID:1132
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                9⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:3508
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\data.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                9⤵
                                                                                  PID:4952
                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                  9⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  PID:2280
                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                  9⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Drops file in Program Files directory
                                                                                  PID:1700
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                    10⤵
                                                                                      PID:2556
                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                        11⤵
                                                                                        • System policy modification
                                                                                        PID:4736
                                                                                • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                  8⤵
                                                                                    PID:2964
                                                                            • C:\Program Files\Internet Explorer\backup.exe
                                                                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                              5⤵
                                                                              • Drops file in Program Files directory
                                                                              PID:2304
                                                                              • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                6⤵
                                                                                • System policy modification
                                                                                PID:312
                                                                              • C:\Program Files\Internet Explorer\en-US\update.exe
                                                                                "C:\Program Files\Internet Explorer\en-US\update.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                6⤵
                                                                                  PID:4408
                                                                                • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                  6⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  PID:2276
                                                                                • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                  6⤵
                                                                                    PID:4964
                                                                                  • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                    "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                    6⤵
                                                                                      PID:4252
                                                                                    • C:\Program Files\Internet Explorer\it-IT\data.exe
                                                                                      "C:\Program Files\Internet Explorer\it-IT\data.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                      6⤵
                                                                                        PID:1176
                                                                                      • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                        "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                        6⤵
                                                                                          PID:1212
                                                                                        • C:\Program Files\Internet Explorer\SIGNUP\System Restore.exe
                                                                                          "C:\Program Files\Internet Explorer\SIGNUP\System Restore.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                          6⤵
                                                                                            PID:3016
                                                                                        • C:\Program Files\Java\backup.exe
                                                                                          "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                          5⤵
                                                                                            PID:4896
                                                                                            • C:\Program Files\Java\jdk1.8.0_66\data.exe
                                                                                              "C:\Program Files\Java\jdk1.8.0_66\data.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                              6⤵
                                                                                              • Drops file in Program Files directory
                                                                                              PID:4172
                                                                                              • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                                "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                                7⤵
                                                                                                • System policy modification
                                                                                                PID:4368
                                                                                              • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                                "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                                7⤵
                                                                                                  PID:3492
                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                                    8⤵
                                                                                                    • System policy modification
                                                                                                    PID:4868
                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                    8⤵
                                                                                                      PID:2540
                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                                    7⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:2252
                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                      8⤵
                                                                                                      • System policy modification
                                                                                                      PID:3504
                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                        9⤵
                                                                                                          PID:5088
                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                      7⤵
                                                                                                      • Drops file in Program Files directory
                                                                                                      • System policy modification
                                                                                                      PID:3044
                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                        8⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:2308
                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                          9⤵
                                                                                                            PID:3944
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                                            9⤵
                                                                                                              PID:212
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                                              9⤵
                                                                                                                PID:4132
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                                              8⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              PID:4840
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                                                            7⤵
                                                                                                              PID:3076
                                                                                                          • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                                            "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                            6⤵
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:4056
                                                                                                            • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                                              "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                              7⤵
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:4928
                                                                                                              • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                                                                "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                8⤵
                                                                                                                  PID:1656
                                                                                                                • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                  8⤵
                                                                                                                    PID:3388
                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                    8⤵
                                                                                                                      PID:5080
                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\backup.exe
                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\
                                                                                                                    7⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    PID:800
                                                                                                              • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                5⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                • System policy modification
                                                                                                                PID:1972
                                                                                                                • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                                  "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                  6⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • System policy modification
                                                                                                                  PID:2632
                                                                                                                • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                                  "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                  6⤵
                                                                                                                    PID:4968
                                                                                                                  • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                                                    "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                    6⤵
                                                                                                                      PID:1584
                                                                                                                      • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                                                        "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                                        7⤵
                                                                                                                          PID:920
                                                                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                                          7⤵
                                                                                                                            PID:2348
                                                                                                                            • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                                                              "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                              8⤵
                                                                                                                                PID:2544
                                                                                                                            • C:\Program Files\Microsoft Office\root\fre\backup.exe
                                                                                                                              "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
                                                                                                                              7⤵
                                                                                                                                PID:1212
                                                                                                                            • C:\Program Files\Microsoft Office\Updates\backup.exe
                                                                                                                              "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
                                                                                                                              6⤵
                                                                                                                                PID:4088
                                                                                                                            • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                                              "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                                              5⤵
                                                                                                                                PID:1800
                                                                                                                            • C:\Program Files (x86)\backup.exe
                                                                                                                              "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                              4⤵
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:5032
                                                                                                                              • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                                5⤵
                                                                                                                                • System policy modification
                                                                                                                                PID:1952
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                                  6⤵
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  PID:1352
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                                    7⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:2820
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                                    7⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    • System policy modification
                                                                                                                                    PID:1592
                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                      8⤵
                                                                                                                                      • System policy modification
                                                                                                                                      PID:4036
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                        9⤵
                                                                                                                                          PID:4504
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                        8⤵
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        PID:1972
                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                          9⤵
                                                                                                                                          • System policy modification
                                                                                                                                          PID:4524
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                        8⤵
                                                                                                                                          PID:4028
                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                          8⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          PID:3424
                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                          8⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:4552
                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                            9⤵
                                                                                                                                              PID:3040
                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                            8⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            PID:4652
                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                              9⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              PID:1968
                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                            8⤵
                                                                                                                                              PID:4984
                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                              8⤵
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              PID:4184
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                9⤵
                                                                                                                                                  PID:628
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                                8⤵
                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                PID:4348
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                  9⤵
                                                                                                                                                    PID:228
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                                  8⤵
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  PID:4400
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                                    9⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:1216
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                      10⤵
                                                                                                                                                        PID:4768
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\System Restore.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                      9⤵
                                                                                                                                                        PID:5012
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                                      8⤵
                                                                                                                                                        PID:4364
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                      7⤵
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:3860
                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                        8⤵
                                                                                                                                                          PID:4296
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                            9⤵
                                                                                                                                                              PID:2940
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                            8⤵
                                                                                                                                                              PID:4912
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                              8⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:4888
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                9⤵
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                PID:2648
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                  10⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  PID:1960
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\update.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                  10⤵
                                                                                                                                                                    PID:3100
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\System Restore.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                              7⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:2100
                                                                                                                                                        • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                          5⤵
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          PID:1396
                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                            6⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            PID:4216
                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                              7⤵
                                                                                                                                                                PID:3228
                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                7⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                PID:8
                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:3736
                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                  7⤵
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  PID:3464
                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                    8⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    PID:1440
                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:4672
                                                                                                                                                                • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                  6⤵
                                                                                                                                                                  • System policy modification
                                                                                                                                                                  PID:4292
                                                                                                                                                              • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:112
                                                                                                                                                              • C:\Users\backup.exe
                                                                                                                                                                C:\Users\backup.exe C:\Users\
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:3292
                                                                                                                                                                  • C:\Users\Admin\backup.exe
                                                                                                                                                                    C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:3152
                                                                                                                                                                      • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                        "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:3156
                                                                                                                                                                        • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                          C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:4416
                                                                                                                                                                          • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                            C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:1292
                                                                                                                                                                            • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                              C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • System policy modification
                                                                                                                                                                              PID:4648
                                                                                                                                                                            • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                              C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:2476
                                                                                                                                                                            • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                              C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:1656
                                                                                                                                                                              • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                6⤵
                                                                                                                                                                                • System policy modification
                                                                                                                                                                                PID:5012
                                                                                                                                                                              • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:768
                                                                                                                                                                                • C:\Users\Admin\OneDrive\data.exe
                                                                                                                                                                                  C:\Users\Admin\OneDrive\data.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:3108
                                                                                                                                                                                • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                  C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:4836
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    PID:532
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:3448
                                                                                                                                                                                  • C:\Users\Admin\Saved Games\System Restore.exe
                                                                                                                                                                                    "C:\Users\Admin\Saved Games\System Restore.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:2560
                                                                                                                                                                                    • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                      C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:1648
                                                                                                                                                                                      • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                        C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:3300
                                                                                                                                                                                      • C:\Users\Public\backup.exe
                                                                                                                                                                                        C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:1672
                                                                                                                                                                                        • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                          C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:1212
                                                                                                                                                                                          • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                            C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:2384
                                                                                                                                                                                            • C:\Users\Public\Music\update.exe
                                                                                                                                                                                              C:\Users\Public\Music\update.exe C:\Users\Public\Music\
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                              PID:4232
                                                                                                                                                                                            • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                              C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                              PID:4812
                                                                                                                                                                                            • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                              C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:2600
                                                                                                                                                                                          • C:\Windows\data.exe
                                                                                                                                                                                            C:\Windows\data.exe C:\Windows\
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:220
                                                                                                                                                                                            • C:\Windows\addins\backup.exe
                                                                                                                                                                                              C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:2576
                                                                                                                                                                                              • C:\Windows\appcompat\backup.exe
                                                                                                                                                                                                C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:4884
                                                                                                                                                                                                • C:\Windows\appcompat\appraiser\data.exe
                                                                                                                                                                                                  C:\Windows\appcompat\appraiser\data.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:1896
                                                                                                                                                                                                  • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                                    C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:2940
                                                                                                                                                                                                  • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                    C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                    • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                      C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                      PID:2128
                                                                                                                                                                                                  • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                                    C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:4944
                                                                                                                                                                                                    • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                                                                                      C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                      • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                                                                                        C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                        • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                                                                                          C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                      • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                                                                                                        C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:2312
                                                                                                                                                                                                        • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                                                                                                          C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                          PID:3960
                                                                                                                                                                                                        • C:\Windows\apppatch\en-US\backup.exe
                                                                                                                                                                                                          C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:4140
                                                                                                                                                                                                        • C:\Windows\AppReadiness\backup.exe
                                                                                                                                                                                                          C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                          PID:2072
                                                                                                                                                                                                        • C:\Windows\assembly\backup.exe
                                                                                                                                                                                                          C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:2004
                                                                                                                                                                                                          • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                                                                                            C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                            • C:\Windows\assembly\GAC\ADODB\update.exe
                                                                                                                                                                                                              C:\Windows\assembly\GAC\ADODB\update.exe C:\Windows\assembly\GAC\ADODB\
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:3156
                                                                                                                                                                                                              • C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:4192
                                                                                                                                                                                                              • C:\Windows\assembly\GAC\Extensibility\backup.exe
                                                                                                                                                                                                                C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:2692
                                                                                                                                                                                                                • C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                  C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:2492
                                                                                                                                                                                                                • C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe
                                                                                                                                                                                                                  C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:4396
                                                                                                                                                                                                                • C:\Windows\assembly\GAC_32\backup.exe
                                                                                                                                                                                                                  C:\Windows\assembly\GAC_32\backup.exe C:\Windows\assembly\GAC_32\
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:668
                                                                                                                                                                                                                • C:\Windows\bcastdvr\backup.exe
                                                                                                                                                                                                                  C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                  PID:3120
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\data.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\acrocef_low\data.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:3052
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:664
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:4776
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:5068
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:4732

                                                                                                                                                                                                        Network

                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                        • C:\PerfLogs\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          afd4b8697cd832532f6ce75a2179a795

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          98e91ad6d602231fb2004bacc304997e08e6421d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          add572790d1f51dec764692c21e9f97d0551d9a31d60875e5c2e224c04f66949

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b6efba3bc5ddac2b2433d4caae20ccec69e43dffdd91fe10ac95c1fdadcff31db4752c240e899a366d2435bdc27a49f49d7dedb9973e0a0bacb7c15d6fcf12d8

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\PerfLogs\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          afd4b8697cd832532f6ce75a2179a795

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          98e91ad6d602231fb2004bacc304997e08e6421d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          add572790d1f51dec764692c21e9f97d0551d9a31d60875e5c2e224c04f66949

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b6efba3bc5ddac2b2433d4caae20ccec69e43dffdd91fe10ac95c1fdadcff31db4752c240e899a366d2435bdc27a49f49d7dedb9973e0a0bacb7c15d6fcf12d8

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          3879f45e3ea2017249b7e6d92308c041

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3805e926dd3eca5cedeff51c554b7a5c8b115edb

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1db2b726d83221e968ae9627f91712fb5c1198317d8f52f8c99d7a5c6d07982d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          2b0321029acef6add81a5ffd52c2c3e7932c56c9200ad82af524625c1c5fa32019e9a46b1346d89be408f5d7d2e3e2205fdeed11baebde7c368f91d01cb22bfb

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          3879f45e3ea2017249b7e6d92308c041

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3805e926dd3eca5cedeff51c554b7a5c8b115edb

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1db2b726d83221e968ae9627f91712fb5c1198317d8f52f8c99d7a5c6d07982d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          2b0321029acef6add81a5ffd52c2c3e7932c56c9200ad82af524625c1c5fa32019e9a46b1346d89be408f5d7d2e3e2205fdeed11baebde7c368f91d01cb22bfb

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5ab3d651faba04ed1cfdbbb843580d9d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2e5d61a0997b2bfe3eb56f526569cc5557756239

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9ab611ed127b8ab1775a8debcc41144f3c0412cb47ce2bee9e40f2d0fda0b763

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5f252b051a13170494c989d5ca12097601bd1dc7ccf52a1b7240648e16399453c2487bdd14a56625d4d184bdad4f684e6fc54c67eee534d0bdad576b68856531

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5ab3d651faba04ed1cfdbbb843580d9d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2e5d61a0997b2bfe3eb56f526569cc5557756239

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9ab611ed127b8ab1775a8debcc41144f3c0412cb47ce2bee9e40f2d0fda0b763

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5f252b051a13170494c989d5ca12097601bd1dc7ccf52a1b7240648e16399453c2487bdd14a56625d4d184bdad4f684e6fc54c67eee534d0bdad576b68856531

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          3879f45e3ea2017249b7e6d92308c041

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3805e926dd3eca5cedeff51c554b7a5c8b115edb

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1db2b726d83221e968ae9627f91712fb5c1198317d8f52f8c99d7a5c6d07982d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          2b0321029acef6add81a5ffd52c2c3e7932c56c9200ad82af524625c1c5fa32019e9a46b1346d89be408f5d7d2e3e2205fdeed11baebde7c368f91d01cb22bfb

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          3879f45e3ea2017249b7e6d92308c041

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3805e926dd3eca5cedeff51c554b7a5c8b115edb

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1db2b726d83221e968ae9627f91712fb5c1198317d8f52f8c99d7a5c6d07982d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          2b0321029acef6add81a5ffd52c2c3e7932c56c9200ad82af524625c1c5fa32019e9a46b1346d89be408f5d7d2e3e2205fdeed11baebde7c368f91d01cb22bfb

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5ab3d651faba04ed1cfdbbb843580d9d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2e5d61a0997b2bfe3eb56f526569cc5557756239

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9ab611ed127b8ab1775a8debcc41144f3c0412cb47ce2bee9e40f2d0fda0b763

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5f252b051a13170494c989d5ca12097601bd1dc7ccf52a1b7240648e16399453c2487bdd14a56625d4d184bdad4f684e6fc54c67eee534d0bdad576b68856531

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5ab3d651faba04ed1cfdbbb843580d9d

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2e5d61a0997b2bfe3eb56f526569cc5557756239

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9ab611ed127b8ab1775a8debcc41144f3c0412cb47ce2bee9e40f2d0fda0b763

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5f252b051a13170494c989d5ca12097601bd1dc7ccf52a1b7240648e16399453c2487bdd14a56625d4d184bdad4f684e6fc54c67eee534d0bdad576b68856531

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4eab99e35b88e8ff2ffa4ecbdb0680ca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          362b60f1ecae22d19e5367be8cadddb184bdfb73

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f5e71bf9b591e0db17188f9cd39c5b97bec39592f7e11af9c40dfafc71d49728

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          38ff051658f706faa6adc08f56a49325a1227348c78cfef2bbb01e67830e8fc9222f572ca94de4eaa83c987948f16cb45c377d8f6c8c7a95496cd6d78c8569bf

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4eab99e35b88e8ff2ffa4ecbdb0680ca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          362b60f1ecae22d19e5367be8cadddb184bdfb73

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f5e71bf9b591e0db17188f9cd39c5b97bec39592f7e11af9c40dfafc71d49728

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          38ff051658f706faa6adc08f56a49325a1227348c78cfef2bbb01e67830e8fc9222f572ca94de4eaa83c987948f16cb45c377d8f6c8c7a95496cd6d78c8569bf

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          55235675d7dd779d128b2a5ee0a08889

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a86f39d9e14f07ff25ce4f77892a5083c254fb12

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d3e6d539df04e8679c7c42f4b1951da53848cd08432ead52dcb0295583256934

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d3f625a9656187394744530a23e6d590fae4d614134ae242903a3cabc18cfe95d26c443dfa534599bfed9e31a430804cd76dea7773014be4ded03670634c0cec

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          55235675d7dd779d128b2a5ee0a08889

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a86f39d9e14f07ff25ce4f77892a5083c254fb12

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d3e6d539df04e8679c7c42f4b1951da53848cd08432ead52dcb0295583256934

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d3f625a9656187394744530a23e6d590fae4d614134ae242903a3cabc18cfe95d26c443dfa534599bfed9e31a430804cd76dea7773014be4ded03670634c0cec

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          bab44ee610c250421cb55eedef4255ee

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2bb53cc1631e3c5b326f8c43abcc38e714f3279a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          90bae4bce57c4effd228b58688f0e75018a80433f075f12e393cc85942a7646c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          84f3cd8f0de85a89d0feeb9fc1268ee27d32fb8e0445c0da936cf451afcf03da0564771f59dfe21c24b34ade8020b03ab162987990ea0ca546546a5fa612d1de

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          bab44ee610c250421cb55eedef4255ee

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2bb53cc1631e3c5b326f8c43abcc38e714f3279a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          90bae4bce57c4effd228b58688f0e75018a80433f075f12e393cc85942a7646c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          84f3cd8f0de85a89d0feeb9fc1268ee27d32fb8e0445c0da936cf451afcf03da0564771f59dfe21c24b34ade8020b03ab162987990ea0ca546546a5fa612d1de

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7c014499bd3e9a8ab05ad904cb96daed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c3dd3f262bf0ad18a932bb9f7ea5803d43a68271

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          87e4496014f4c8d63649deef9d6a7ad281bc6e9733b91bbbb6f4812a79db5788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ffa812e7de7f94ec48e711313f4b610fee47b7eb2b60bbd3bd2c4359f2efb8af90ede8aac06e66d8258ee84ca0db58f149955b3fce044ca016866f817e5ef56d

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          fe19f851758e00df1910ea39dbba9b27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ea006acc3fd73b052cfe280ccffc7bae4230a357

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          62dd1836e060f7b04ec82475e5d244e3e2849d5bc8b51f507c9f54616d102962

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          e29cae4e1c2019f5cf41332720d70185712df68d48931c2c9298ddca6d20d02567750d113868a63336d2c9ebd82bc0db9676bfee56da66ccfad71758f8dbe66a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          15ce6dbe5b4294be3b46305c7d41f948

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4526025ce9c96a32f349a110be5578979ee59c27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3b238796fcc1e536a11ab8c6a53bc3f0afea06bd86922f4beb26608f414e75bd

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          43d73ba267f9121ca98fb3f0f2cf3f3d40555ccc81e94780be78c439ce6bdd5835fe3a5f74b8c5e749fc089a3dea834b0cde604432dbd7526edf000d14c4233a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          15ce6dbe5b4294be3b46305c7d41f948

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4526025ce9c96a32f349a110be5578979ee59c27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3b238796fcc1e536a11ab8c6a53bc3f0afea06bd86922f4beb26608f414e75bd

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          43d73ba267f9121ca98fb3f0f2cf3f3d40555ccc81e94780be78c439ce6bdd5835fe3a5f74b8c5e749fc089a3dea834b0cde604432dbd7526edf000d14c4233a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          15ce6dbe5b4294be3b46305c7d41f948

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4526025ce9c96a32f349a110be5578979ee59c27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3b238796fcc1e536a11ab8c6a53bc3f0afea06bd86922f4beb26608f414e75bd

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          43d73ba267f9121ca98fb3f0f2cf3f3d40555ccc81e94780be78c439ce6bdd5835fe3a5f74b8c5e749fc089a3dea834b0cde604432dbd7526edf000d14c4233a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          15ce6dbe5b4294be3b46305c7d41f948

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4526025ce9c96a32f349a110be5578979ee59c27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3b238796fcc1e536a11ab8c6a53bc3f0afea06bd86922f4beb26608f414e75bd

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          43d73ba267f9121ca98fb3f0f2cf3f3d40555ccc81e94780be78c439ce6bdd5835fe3a5f74b8c5e749fc089a3dea834b0cde604432dbd7526edf000d14c4233a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          15ce6dbe5b4294be3b46305c7d41f948

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4526025ce9c96a32f349a110be5578979ee59c27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3b238796fcc1e536a11ab8c6a53bc3f0afea06bd86922f4beb26608f414e75bd

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          43d73ba267f9121ca98fb3f0f2cf3f3d40555ccc81e94780be78c439ce6bdd5835fe3a5f74b8c5e749fc089a3dea834b0cde604432dbd7526edf000d14c4233a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          15ce6dbe5b4294be3b46305c7d41f948

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4526025ce9c96a32f349a110be5578979ee59c27

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3b238796fcc1e536a11ab8c6a53bc3f0afea06bd86922f4beb26608f414e75bd

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          43d73ba267f9121ca98fb3f0f2cf3f3d40555ccc81e94780be78c439ce6bdd5835fe3a5f74b8c5e749fc089a3dea834b0cde604432dbd7526edf000d14c4233a

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\update.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4eab99e35b88e8ff2ffa4ecbdb0680ca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          362b60f1ecae22d19e5367be8cadddb184bdfb73

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f5e71bf9b591e0db17188f9cd39c5b97bec39592f7e11af9c40dfafc71d49728

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          38ff051658f706faa6adc08f56a49325a1227348c78cfef2bbb01e67830e8fc9222f572ca94de4eaa83c987948f16cb45c377d8f6c8c7a95496cd6d78c8569bf

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\update.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          4eab99e35b88e8ff2ffa4ecbdb0680ca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          362b60f1ecae22d19e5367be8cadddb184bdfb73

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f5e71bf9b591e0db17188f9cd39c5b97bec39592f7e11af9c40dfafc71d49728

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          38ff051658f706faa6adc08f56a49325a1227348c78cfef2bbb01e67830e8fc9222f572ca94de4eaa83c987948f16cb45c377d8f6c8c7a95496cd6d78c8569bf

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\data.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          afd4b8697cd832532f6ce75a2179a795

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          98e91ad6d602231fb2004bacc304997e08e6421d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          add572790d1f51dec764692c21e9f97d0551d9a31d60875e5c2e224c04f66949

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b6efba3bc5ddac2b2433d4caae20ccec69e43dffdd91fe10ac95c1fdadcff31db4752c240e899a366d2435bdc27a49f49d7dedb9973e0a0bacb7c15d6fcf12d8

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Program Files\data.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          afd4b8697cd832532f6ce75a2179a795

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          98e91ad6d602231fb2004bacc304997e08e6421d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          add572790d1f51dec764692c21e9f97d0551d9a31d60875e5c2e224c04f66949

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b6efba3bc5ddac2b2433d4caae20ccec69e43dffdd91fe10ac95c1fdadcff31db4752c240e899a366d2435bdc27a49f49d7dedb9973e0a0bacb7c15d6fcf12d8

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\539485856\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1c75533f60d577e5f19365b6a0caf2e2

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3a3dde70b99a49da9dd53a19d7c8e30b6d8412a9

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d5edca7e38feae1059190a485ae33863c4e37b95864c68ea50c68b62c546ac28

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1c0a4e27c06e90f950a25564765e664d2d2c5fb40207a10453ed0ce97bad0d9572cd337d638408a1ce120bce258f0f9ec1b4611078ca1c7b438caffe6d52060c

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\539485856\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1c75533f60d577e5f19365b6a0caf2e2

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3a3dde70b99a49da9dd53a19d7c8e30b6d8412a9

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d5edca7e38feae1059190a485ae33863c4e37b95864c68ea50c68b62c546ac28

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1c0a4e27c06e90f950a25564765e664d2d2c5fb40207a10453ed0ce97bad0d9572cd337d638408a1ce120bce258f0f9ec1b4611078ca1c7b438caffe6d52060c

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\data.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\data.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a02ce2a7efbed486dd2501df53a78dca

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          999b70d47386d52262bb642c007f5b56e1f975ff

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          31a2950a144fe4699edb5ca8f9eb3a6e7757f420415be087b31f8dec28c56a6b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fc2534065ba8b0a75d7df87c99d25eb93315650b2b815f2ab08adfaf6dc8ab4942e9e31852c3da14180ab8b11e6d2f8a0001776971d3492f074f7df7dea0a569

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          de7c5979361f2c403c4cdd27406fbd07

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          108e58bb685ba7ba9516391aefe48f0494852461

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3e200ac9bdecb593f18b46570047cc42ed4a342ec02741a7268c2a71c0d2f60d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          c069aba9761ca6060c41b9563c725da560b4483849eeb54a5cc18cc98e80d9cdf983600522d88fdb151ddc60e3881758cda7ba5d1b062c2573f403f10f3d8ba3

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          de7c5979361f2c403c4cdd27406fbd07

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          108e58bb685ba7ba9516391aefe48f0494852461

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          3e200ac9bdecb593f18b46570047cc42ed4a342ec02741a7268c2a71c0d2f60d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          c069aba9761ca6060c41b9563c725da560b4483849eeb54a5cc18cc98e80d9cdf983600522d88fdb151ddc60e3881758cda7ba5d1b062c2573f403f10f3d8ba3

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\odt\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          08ef41f5b795fe25d9339b1378471e27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          f622491850020123676d5996dfa2e7c32ec9a9f8

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d4730a9f37caf982f557f461f74bbf74116e7d4e082c0b9007200755416ca5d4

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          599db171d985787a0b0abd3363900a9be5569bdb0a7bc69088e0b7d079b3ab90d64c22650cdb89113aa9704f1f7f97bc607898da170c51b9eba4acc98f803876

                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                        • C:\odt\backup.exe
                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          08ef41f5b795fe25d9339b1378471e27

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          f622491850020123676d5996dfa2e7c32ec9a9f8

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d4730a9f37caf982f557f461f74bbf74116e7d4e082c0b9007200755416ca5d4

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          599db171d985787a0b0abd3363900a9be5569bdb0a7bc69088e0b7d079b3ab90d64c22650cdb89113aa9704f1f7f97bc607898da170c51b9eba4acc98f803876

                                                                                                                                                                                                          Download Submit