Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    182s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2022, 06:09

General

  • Target

    226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe

  • Size

    72KB

  • MD5

    01d1587763dda17b7ae02a71b03ba4a3

  • SHA1

    1f42998db5f36920a83f3d86ac9b765ee998571b

  • SHA256

    226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e

  • SHA512

    0abe26235832c79f6a93a6647dbe63ac50a5c7a1fce907aa224db60d48d8454b0270065dd6a5942a05cbad720ce1ab531d815b41ef805c0dd1b6d09ac143ab9d

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2W:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr6

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe
    "C:\Users\Admin\AppData\Local\Temp\226a4e5a5329002832868f2588f390cc2c920d418520dc1211b6485ca066924e.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Users\Admin\AppData\Local\Temp\784939236\backup.exe
      C:\Users\Admin\AppData\Local\Temp\784939236\backup.exe C:\Users\Admin\AppData\Local\Temp\784939236\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3676
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3500
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2172
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3668
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3636
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:556
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3720
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1596
            • C:\Program Files\Common Files\DESIGNER\data.exe
              "C:\Program Files\Common Files\DESIGNER\data.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4464
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2204
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4632
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1448
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4420
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4232
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4104
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1028
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2456
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3496
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1412
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1340
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4776
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4136
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1064
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4984
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2420
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4884
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4608
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3860
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4220
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5020
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2376
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3156
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4516
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3180
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2964
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1732
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3944
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3964
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2084
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:424
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1084
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:2092
                • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                  8⤵
                    PID:3656
                  • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1396
                  • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:4420
                  • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1028
                  • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                    8⤵
                      PID:3392
                    • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                      8⤵
                        PID:4180
                      • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:728
                      • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\System Restore.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:1300
                      • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                        8⤵
                          PID:2692
                        • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                          8⤵
                            PID:2708
                          • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                            8⤵
                              PID:4464
                            • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                              8⤵
                                PID:4960
                              • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                PID:3956
                              • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                                8⤵
                                  PID:932
                                • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                                  8⤵
                                  • System policy modification
                                  PID:5068
                                • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                                  8⤵
                                  • System policy modification
                                  PID:2144
                                • C:\Program Files\Common Files\microsoft shared\ink\th-TH\update.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\th-TH\update.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:4844
                                • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\System Restore.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                                  8⤵
                                  • Disables RegEdit via registry modification
                                  PID:4344
                                • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                                  8⤵
                                    PID:1048
                                  • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    PID:3012
                                  • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:1408
                                • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                  7⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5116
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                    8⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4736
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                    8⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:844
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:4740
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    PID:3492
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                    8⤵
                                      PID:1040
                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:4632
                                  • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                    7⤵
                                    • System policy modification
                                    PID:4012
                                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System policy modification
                                      PID:460
                                  • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                    7⤵
                                      PID:4968
                                    • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                      7⤵
                                        PID:4468
                                      • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                        7⤵
                                          PID:2644
                                        • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                          7⤵
                                            PID:3608
                                            • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                              8⤵
                                                PID:3260
                                            • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                              7⤵
                                              • Drops file in Program Files directory
                                              PID:3392
                                              • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\update.exe
                                                "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\update.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                8⤵
                                                • System policy modification
                                                PID:1900
                                            • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                              7⤵
                                              • Disables RegEdit via registry modification
                                              PID:4296
                                            • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:1984
                                            • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                              7⤵
                                                PID:2108
                                                • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                  8⤵
                                                    PID:1028
                                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                      9⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:3456
                                              • C:\Program Files\Common Files\Services\backup.exe
                                                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1976
                                              • C:\Program Files\Common Files\System\data.exe
                                                "C:\Program Files\Common Files\System\data.exe" C:\Program Files\Common Files\System\
                                                6⤵
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1420
                                                • C:\Program Files\Common Files\System\ado\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                  7⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4324
                                                  • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:2932
                                                  • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1624
                                                  • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                    8⤵
                                                    • System policy modification
                                                    PID:3476
                                                  • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                    8⤵
                                                      PID:5088
                                                    • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                      8⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      PID:1836
                                                    • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                      8⤵
                                                        PID:3012
                                                    • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                      "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                      7⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:4140
                                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                      7⤵
                                                        PID:4360
                                                      • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                        7⤵
                                                          PID:3604
                                                        • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                          "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                          7⤵
                                                            PID:1976
                                                          • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                            "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                            7⤵
                                                            • Disables RegEdit via registry modification
                                                            • System policy modification
                                                            PID:2412
                                                          • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                            "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                            7⤵
                                                              PID:3140
                                                            • C:\Program Files\Common Files\System\msadc\backup.exe
                                                              "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                              7⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System policy modification
                                                              PID:1904
                                                              • C:\Program Files\Common Files\System\msadc\de-DE\update.exe
                                                                "C:\Program Files\Common Files\System\msadc\de-DE\update.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                8⤵
                                                                  PID:444
                                                                • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                  8⤵
                                                                    PID:4936
                                                                  • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                    "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                    8⤵
                                                                    • System policy modification
                                                                    PID:840
                                                                  • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                    "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                    8⤵
                                                                      PID:4684
                                                                    • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                      "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                      8⤵
                                                                        PID:3824
                                                                      • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                        "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                        8⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:1004
                                                                    • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                      "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                      7⤵
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:1544
                                                                      • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                        "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                        8⤵
                                                                          PID:4456
                                                                        • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                          "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • System policy modification
                                                                          PID:3496
                                                                        • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                          "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                          8⤵
                                                                            PID:1980
                                                                          • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                            "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                            8⤵
                                                                              PID:2324
                                                                            • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                              "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                              8⤵
                                                                                PID:1920
                                                                              • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                                "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                                8⤵
                                                                                  PID:3076
                                                                          • C:\Program Files\Google\backup.exe
                                                                            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:932
                                                                            • C:\Program Files\Google\Chrome\backup.exe
                                                                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2564
                                                                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                                7⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2000
                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                  8⤵
                                                                                  • Drops file in Program Files directory
                                                                                  PID:3136
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                    9⤵
                                                                                      PID:2540
                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                      9⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:524
                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                      9⤵
                                                                                        PID:3084
                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                        9⤵
                                                                                          PID:3956
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                          9⤵
                                                                                            PID:1636
                                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                            9⤵
                                                                                              PID:64
                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                              9⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:1404
                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\update.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                              9⤵
                                                                                              • System policy modification
                                                                                              PID:4696
                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                                10⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                PID:4796
                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                  11⤵
                                                                                                    PID:4964
                                                                                            • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                              8⤵
                                                                                                PID:1552
                                                                                        • C:\Program Files\Internet Explorer\backup.exe
                                                                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                          5⤵
                                                                                          • Drops file in Program Files directory
                                                                                          PID:672
                                                                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                            6⤵
                                                                                              PID:2432
                                                                                            • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                              "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                              6⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              • System policy modification
                                                                                              PID:4376
                                                                                            • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                              "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                              6⤵
                                                                                                PID:3996
                                                                                              • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                                "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                                6⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                PID:4104
                                                                                              • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                                "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                                6⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                • System policy modification
                                                                                                PID:2468
                                                                                              • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                                "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                                6⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • System policy modification
                                                                                                PID:1920
                                                                                              • C:\Program Files\Internet Explorer\ja-JP\System Restore.exe
                                                                                                "C:\Program Files\Internet Explorer\ja-JP\System Restore.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                                6⤵
                                                                                                  PID:3156
                                                                                                • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                                  "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                                  6⤵
                                                                                                    PID:1300
                                                                                                • C:\Program Files\Java\backup.exe
                                                                                                  "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                                  5⤵
                                                                                                    PID:1384
                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\update.exe
                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\update.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                                      6⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Drops file in Program Files directory
                                                                                                      PID:3748
                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\bin\update.exe
                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\bin\update.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                                        7⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:3608
                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                                        7⤵
                                                                                                          PID:3780
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                                            8⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            PID:3240
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                            8⤵
                                                                                                              PID:1848
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                                            7⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            PID:4468
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                              8⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:3108
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                                9⤵
                                                                                                                  PID:3848
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                              7⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:1036
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                                8⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                PID:776
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                                  9⤵
                                                                                                                    PID:2760
                                                                                                            • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                                              "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                              6⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:1732
                                                                                                              • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                                                "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                                7⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                PID:1412
                                                                                                                • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                  8⤵
                                                                                                                    PID:3988
                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                    8⤵
                                                                                                                    • System policy modification
                                                                                                                    PID:2704
                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                    8⤵
                                                                                                                      PID:4068
                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\backup.exe
                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\
                                                                                                                    7⤵
                                                                                                                      PID:916
                                                                                                                • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                  5⤵
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  PID:64
                                                                                                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                    6⤵
                                                                                                                      PID:728
                                                                                                                    • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                                      "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                      6⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • System policy modification
                                                                                                                      PID:2744
                                                                                                                    • C:\Program Files\Microsoft Office\root\update.exe
                                                                                                                      "C:\Program Files\Microsoft Office\root\update.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                      6⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      PID:1704
                                                                                                                      • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                                                        "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                                        7⤵
                                                                                                                          PID:4136
                                                                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                                          7⤵
                                                                                                                          • System policy modification
                                                                                                                          PID:3352
                                                                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                                                            "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                            8⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            PID:2784
                                                                                                                    • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                                      "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                                      5⤵
                                                                                                                        PID:3520
                                                                                                                    • C:\Program Files (x86)\backup.exe
                                                                                                                      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                      4⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:2596
                                                                                                                      • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:2668
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                          6⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          • System policy modification
                                                                                                                          PID:972
                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                            7⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:2412
                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                            7⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:4800
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                              8⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:936
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                9⤵
                                                                                                                                  PID:3464
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                8⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                PID:4164
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                  9⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  PID:4080
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                8⤵
                                                                                                                                  PID:4296
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                  8⤵
                                                                                                                                    PID:3068
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                    8⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    PID:4736
                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                      9⤵
                                                                                                                                      • System policy modification
                                                                                                                                      PID:1056
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                    8⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    PID:2640
                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                      9⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      PID:4184
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                    8⤵
                                                                                                                                      PID:4980
                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                      8⤵
                                                                                                                                        PID:400
                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                          9⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          PID:992
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                        8⤵
                                                                                                                                          PID:3860
                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\System Restore.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                            9⤵
                                                                                                                                              PID:3316
                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                            8⤵
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:2708
                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                              9⤵
                                                                                                                                                PID:2428
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                  10⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  PID:1116
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                9⤵
                                                                                                                                                • System policy modification
                                                                                                                                                PID:4956
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                  10⤵
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:3544
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                    11⤵
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    PID:3756
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                                                                                9⤵
                                                                                                                                                  PID:2344
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                                    10⤵
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:3612
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                                                                                  9⤵
                                                                                                                                                    PID:3260
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                                  8⤵
                                                                                                                                                    PID:3428
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                                                      9⤵
                                                                                                                                                        PID:4376
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                                                      8⤵
                                                                                                                                                        PID:4856
                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                                                        8⤵
                                                                                                                                                          PID:4088
                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                                                                                          8⤵
                                                                                                                                                            PID:4748
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
                                                                                                                                                              9⤵
                                                                                                                                                                PID:2324
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\System Restore.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                            7⤵
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            PID:4940
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                              8⤵
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:1884
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                                9⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                PID:4704
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                              8⤵
                                                                                                                                                                PID:2428
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                                8⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                PID:5100
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                  9⤵
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  PID:4140
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                    10⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:5096
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                    10⤵
                                                                                                                                                                      PID:1772
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\System Restore.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                                        11⤵
                                                                                                                                                                          PID:1752
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                                          11⤵
                                                                                                                                                                            PID:1164
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                                            11⤵
                                                                                                                                                                              PID:1480
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      PID:4756
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:2116
                                                                                                                                                                  • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                    PID:4148
                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                      6⤵
                                                                                                                                                                      • System policy modification
                                                                                                                                                                      PID:388
                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:2148
                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                          7⤵
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          PID:2304
                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                                            8⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            PID:1036
                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe
                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                          7⤵
                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          PID:1160
                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\update.exe
                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\update.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                            8⤵
                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                            PID:776
                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                          7⤵
                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                          PID:4180
                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                                                            8⤵
                                                                                                                                                                            • System policy modification
                                                                                                                                                                            PID:3604
                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:1976
                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                                                                  10⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:2644
                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                                                                  10⤵
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  PID:2760
                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\update.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                                                                    11⤵
                                                                                                                                                                                      PID:1620
                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                                                                                                      11⤵
                                                                                                                                                                                        PID:1844
                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                                                                                                          12⤵
                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                          PID:2668
                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
                                                                                                                                                                                            13⤵
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            PID:4984
                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
                                                                                                                                                                                              14⤵
                                                                                                                                                                                                PID:5068
                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\System Restore.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
                                                                                                                                                                                                14⤵
                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                PID:2748
                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\
                                                                                                                                                                                                14⤵
                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                PID:2172
                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\
                                                                                                                                                                                              13⤵
                                                                                                                                                                                                PID:3116
                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\
                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                    PID:672
                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\
                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\
                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                      PID:4172
                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\
                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                      PID:1444
                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\
                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                          PID:3624
                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\
                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                            PID:4076
                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:1636
                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                PID:1984
                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                              PID:3932
                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\update.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:3492
                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:3528
                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                    PID:3068
                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:4692
                                                                                                                                                                                                • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                  PID:3964
                                                                                                                                                                                                  • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                  • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                    PID:2540
                                                                                                                                                                                                  • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                  • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                    PID:820
                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:4956
                                                                                                                                                                                                • C:\Users\backup.exe
                                                                                                                                                                                                  C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                  PID:4792
                                                                                                                                                                                                  • C:\Users\Admin\backup.exe
                                                                                                                                                                                                    C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                    • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                                                      "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:2172
                                                                                                                                                                                                      • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                                                        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:1452
                                                                                                                                                                                                        • C:\Users\Admin\Desktop\data.exe
                                                                                                                                                                                                          C:\Users\Admin\Desktop\data.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                          PID:4420
                                                                                                                                                                                                        • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                          C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:4324
                                                                                                                                                                                                          • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                            C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:1460
                                                                                                                                                                                                            • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                              C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:1268
                                                                                                                                                                                                              • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                                                C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:3060
                                                                                                                                                                                                                • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                                                  C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:4072
                                                                                                                                                                                                                  • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                                                                    C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                    PID:2416
                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\System Restore.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\System Restore.exe" C:\Users\Admin\Pictures\
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:3164
                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:2540
                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:3292
                                                                                                                                                                                                                        • C:\Users\Admin\Saved Games\System Restore.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Saved Games\System Restore.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                          PID:4084
                                                                                                                                                                                                                        • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                                                          C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                          PID:3588
                                                                                                                                                                                                                        • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                                                          C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:4936
                                                                                                                                                                                                                        • C:\Users\Public\backup.exe
                                                                                                                                                                                                                          C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                          PID:2564
                                                                                                                                                                                                                          • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                            C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:2320
                                                                                                                                                                                                                            • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                              C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                              PID:5056
                                                                                                                                                                                                                            • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                                              C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                              PID:2184
                                                                                                                                                                                                                            • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                                                              C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:3232
                                                                                                                                                                                                                              • C:\Users\Public\Videos\update.exe
                                                                                                                                                                                                                                C:\Users\Public\Videos\update.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                PID:4820
                                                                                                                                                                                                                          • C:\Windows\backup.exe
                                                                                                                                                                                                                            C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                            PID:2508
                                                                                                                                                                                                                            • C:\Windows\addins\backup.exe
                                                                                                                                                                                                                              C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                              PID:3828
                                                                                                                                                                                                                            • C:\Windows\appcompat\backup.exe
                                                                                                                                                                                                                              C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                              PID:4804
                                                                                                                                                                                                                              • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                                                                C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:1936
                                                                                                                                                                                                                                • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                                                                  C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                              • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                                                C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:4064
                                                                                                                                                                                                                                • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                                                  C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                  PID:32
                                                                                                                                                                                                                              • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                                                                C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:4248
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4800
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                          PID:4248
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:1504
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:2692
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:1536

                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                      • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        087e545aad675b5e08ba8e2f9ac159d6

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        87cb99e6a348e54e4c01b720772136230e1b9c2d

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        7fd549ca8a11c0ac0e13d49924ecc8dd79182a817591e2b6a17163a82c1da4b4

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        f19f2ea17f73a312ec07d18c450c4853ef0caf3cdc81db52d5633e548f8fdf14c1e9b41e67f28df9bde6cf674fe2c24061e056ecec864f31f1f1c72f72a99de7

                                                                                                                                                                                                                      • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        087e545aad675b5e08ba8e2f9ac159d6

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        87cb99e6a348e54e4c01b720772136230e1b9c2d

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        7fd549ca8a11c0ac0e13d49924ecc8dd79182a817591e2b6a17163a82c1da4b4

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        f19f2ea17f73a312ec07d18c450c4853ef0caf3cdc81db52d5633e548f8fdf14c1e9b41e67f28df9bde6cf674fe2c24061e056ecec864f31f1f1c72f72a99de7

                                                                                                                                                                                                                      • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        83a8b185c6fdeae22f5631309d43c049

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        8f5bec0629650f4c55df7f969a008986d0a3886c

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f8cfd1e60db3d21146ff9fbdb1ceabf31efd80162b19167cbb64aa5e08503496

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        74fd87a0f8182080e67b7dd2eb3c97c67beee6a3ac70954a9f7ed48a5e8774a42ecc1c9cf0b781d13ebe61b6310dd93cb574b8da3b771ebb8ebe6316d5d8eb28

                                                                                                                                                                                                                      • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        83a8b185c6fdeae22f5631309d43c049

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        8f5bec0629650f4c55df7f969a008986d0a3886c

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f8cfd1e60db3d21146ff9fbdb1ceabf31efd80162b19167cbb64aa5e08503496

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        74fd87a0f8182080e67b7dd2eb3c97c67beee6a3ac70954a9f7ed48a5e8774a42ecc1c9cf0b781d13ebe61b6310dd93cb574b8da3b771ebb8ebe6316d5d8eb28

                                                                                                                                                                                                                      • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        9cd43aa2067c07d3e4139cfdb14312a4

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        62e8c3363ab72c34520faa0a18baae0fc43e47fa

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        c95095e98832c0bc5caf24dda2ab85f7ea72f4e66d432828600e6cb80f5e511e

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        d2a51b365a0adeb7ade7357d1127b8f1b8165099f7f77fc9f18b263f37c65ad590f09707570fdbb854d0f5e918308d710ac555988e0bebc2b4d96c1587cf1cac

                                                                                                                                                                                                                      • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        9cd43aa2067c07d3e4139cfdb14312a4

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        62e8c3363ab72c34520faa0a18baae0fc43e47fa

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        c95095e98832c0bc5caf24dda2ab85f7ea72f4e66d432828600e6cb80f5e511e

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        d2a51b365a0adeb7ade7357d1127b8f1b8165099f7f77fc9f18b263f37c65ad590f09707570fdbb854d0f5e918308d710ac555988e0bebc2b4d96c1587cf1cac

                                                                                                                                                                                                                      • C:\Program Files\Common Files\DESIGNER\data.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a9efb27a7d02310771f34343ab2d2810

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ebf16a1f0db13a74e4cb9c0b223e8ac6a52994c2

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        088012874e5ebde1079283b71f2703e63b2756305cf46e415198c2d070ef8073

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        0b8c8337f4631c7522767e9caaf53b20f764053950926c69ce0ba4fca8728bae7bd9939ae1984e7123242cf4a5c6eaaccff1767c1a4d84e6c0600ea6fc81c9de

                                                                                                                                                                                                                      • C:\Program Files\Common Files\DESIGNER\data.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a9efb27a7d02310771f34343ab2d2810

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ebf16a1f0db13a74e4cb9c0b223e8ac6a52994c2

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        088012874e5ebde1079283b71f2703e63b2756305cf46e415198c2d070ef8073

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        0b8c8337f4631c7522767e9caaf53b20f764053950926c69ce0ba4fca8728bae7bd9939ae1984e7123242cf4a5c6eaaccff1767c1a4d84e6c0600ea6fc81c9de

                                                                                                                                                                                                                      • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        31b1faeb31b3e566791757fabe147e26

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        035a4deacb5b03e462df9c301121cd6dc7e9f567

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        e39305e5be57045088308dcb34dfbf9237fb0f80e9416426e50cce74eaf3f5d5

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        97bbba8b86e339a8994ebb7bedef84386eb6f52a36d30ae90cb54f14ff4d8067a8cdae89a81a1f1c215beffaaab968fdcfa11f1abb5ad655ec29d5f26eff9daa

                                                                                                                                                                                                                      • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        31b1faeb31b3e566791757fabe147e26

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        035a4deacb5b03e462df9c301121cd6dc7e9f567

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        e39305e5be57045088308dcb34dfbf9237fb0f80e9416426e50cce74eaf3f5d5

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        97bbba8b86e339a8994ebb7bedef84386eb6f52a36d30ae90cb54f14ff4d8067a8cdae89a81a1f1c215beffaaab968fdcfa11f1abb5ad655ec29d5f26eff9daa

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f8a8e5245e620e6870cf7b51b0dcf119

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        caccde1642cd161013716ac4f6709d6d34abf444

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        cb23d3e262e72579dec007ef317a457c7129285b34ec6e1dae91ab6ce56d3429

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        9cbb4a45723deee38c7e98e4d7bd2e80178816abb30a1fe8a742e54f3cd569181472dc431292b7579ba186efeaab38be0dd8d59d52f620bca2a418cb0b7bb96b

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f8a8e5245e620e6870cf7b51b0dcf119

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        caccde1642cd161013716ac4f6709d6d34abf444

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        cb23d3e262e72579dec007ef317a457c7129285b34ec6e1dae91ab6ce56d3429

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        9cbb4a45723deee38c7e98e4d7bd2e80178816abb30a1fe8a742e54f3cd569181472dc431292b7579ba186efeaab38be0dd8d59d52f620bca2a418cb0b7bb96b

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a9efb27a7d02310771f34343ab2d2810

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ebf16a1f0db13a74e4cb9c0b223e8ac6a52994c2

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        088012874e5ebde1079283b71f2703e63b2756305cf46e415198c2d070ef8073

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        0b8c8337f4631c7522767e9caaf53b20f764053950926c69ce0ba4fca8728bae7bd9939ae1984e7123242cf4a5c6eaaccff1767c1a4d84e6c0600ea6fc81c9de

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a9efb27a7d02310771f34343ab2d2810

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ebf16a1f0db13a74e4cb9c0b223e8ac6a52994c2

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        088012874e5ebde1079283b71f2703e63b2756305cf46e415198c2d070ef8073

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        0b8c8337f4631c7522767e9caaf53b20f764053950926c69ce0ba4fca8728bae7bd9939ae1984e7123242cf4a5c6eaaccff1767c1a4d84e6c0600ea6fc81c9de

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f8a8e5245e620e6870cf7b51b0dcf119

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        caccde1642cd161013716ac4f6709d6d34abf444

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        cb23d3e262e72579dec007ef317a457c7129285b34ec6e1dae91ab6ce56d3429

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        9cbb4a45723deee38c7e98e4d7bd2e80178816abb30a1fe8a742e54f3cd569181472dc431292b7579ba186efeaab38be0dd8d59d52f620bca2a418cb0b7bb96b

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f8a8e5245e620e6870cf7b51b0dcf119

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        caccde1642cd161013716ac4f6709d6d34abf444

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        cb23d3e262e72579dec007ef317a457c7129285b34ec6e1dae91ab6ce56d3429

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        9cbb4a45723deee38c7e98e4d7bd2e80178816abb30a1fe8a742e54f3cd569181472dc431292b7579ba186efeaab38be0dd8d59d52f620bca2a418cb0b7bb96b

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2b1dc68c1d35264cadc14f32d7bb4845

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ccc0a590982b7eb48c727666555f2cd9c2f54514

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        4a1affa62cd09146a6782d01aec032b07b388a12cd56d48bb688383dc5667d45

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        20dc1340872d636240aead00c6b2a3f1f163b65e39d639eaa5e06a33ff683c1f7475cc8b10ff25b73ef5839ed98edcc767e9dcf0a60f94e4f8df228d8f1f83b8

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a3b156de5b6c6110c7479d7e8ef1309

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4856d8fa40c09b630df34d136838c5523f3c5486

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        964f015c2620f4e9365ebcdb35ab74bda6fe7af68e48d0c2319c60e352fdbcbc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a7c6fc54f36f712d8d5f1d8d050cb6f4a11304a5a1ade68a7c91920454b09add2a5f1600b7c6b6ded73144c91671bd479e1b887a1f2921ed65cc7aacc5d8dc0

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a3b156de5b6c6110c7479d7e8ef1309

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4856d8fa40c09b630df34d136838c5523f3c5486

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        964f015c2620f4e9365ebcdb35ab74bda6fe7af68e48d0c2319c60e352fdbcbc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a7c6fc54f36f712d8d5f1d8d050cb6f4a11304a5a1ade68a7c91920454b09add2a5f1600b7c6b6ded73144c91671bd479e1b887a1f2921ed65cc7aacc5d8dc0

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a3b156de5b6c6110c7479d7e8ef1309

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4856d8fa40c09b630df34d136838c5523f3c5486

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        964f015c2620f4e9365ebcdb35ab74bda6fe7af68e48d0c2319c60e352fdbcbc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a7c6fc54f36f712d8d5f1d8d050cb6f4a11304a5a1ade68a7c91920454b09add2a5f1600b7c6b6ded73144c91671bd479e1b887a1f2921ed65cc7aacc5d8dc0

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a3b156de5b6c6110c7479d7e8ef1309

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4856d8fa40c09b630df34d136838c5523f3c5486

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        964f015c2620f4e9365ebcdb35ab74bda6fe7af68e48d0c2319c60e352fdbcbc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a7c6fc54f36f712d8d5f1d8d050cb6f4a11304a5a1ade68a7c91920454b09add2a5f1600b7c6b6ded73144c91671bd479e1b887a1f2921ed65cc7aacc5d8dc0

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a3b156de5b6c6110c7479d7e8ef1309

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4856d8fa40c09b630df34d136838c5523f3c5486

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        964f015c2620f4e9365ebcdb35ab74bda6fe7af68e48d0c2319c60e352fdbcbc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a7c6fc54f36f712d8d5f1d8d050cb6f4a11304a5a1ade68a7c91920454b09add2a5f1600b7c6b6ded73144c91671bd479e1b887a1f2921ed65cc7aacc5d8dc0

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a3b156de5b6c6110c7479d7e8ef1309

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4856d8fa40c09b630df34d136838c5523f3c5486

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        964f015c2620f4e9365ebcdb35ab74bda6fe7af68e48d0c2319c60e352fdbcbc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a7c6fc54f36f712d8d5f1d8d050cb6f4a11304a5a1ade68a7c91920454b09add2a5f1600b7c6b6ded73144c91671bd479e1b887a1f2921ed65cc7aacc5d8dc0

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a3b156de5b6c6110c7479d7e8ef1309

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4856d8fa40c09b630df34d136838c5523f3c5486

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        964f015c2620f4e9365ebcdb35ab74bda6fe7af68e48d0c2319c60e352fdbcbc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a7c6fc54f36f712d8d5f1d8d050cb6f4a11304a5a1ade68a7c91920454b09add2a5f1600b7c6b6ded73144c91671bd479e1b887a1f2921ed65cc7aacc5d8dc0

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a3b156de5b6c6110c7479d7e8ef1309

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4856d8fa40c09b630df34d136838c5523f3c5486

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        964f015c2620f4e9365ebcdb35ab74bda6fe7af68e48d0c2319c60e352fdbcbc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a7c6fc54f36f712d8d5f1d8d050cb6f4a11304a5a1ade68a7c91920454b09add2a5f1600b7c6b6ded73144c91671bd479e1b887a1f2921ed65cc7aacc5d8dc0

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a48e5b020ac9e48eff876cebebb69fa8

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        86a3369cdc8aee8921b10f5a9263ef522cdaea86

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3678c7a55d985699695a5bad7147c9f9114cd63126a49cc2c6ce2ccdd50dfb5d

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        22916699ea8ec50efdcafa7a6f4ef04a113d4261d7987eb426b752eff1846565530ae7396a2a2a8f9629adeff7421bcc3738e319fcabea8ad52767b1f4b5caba

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a48e5b020ac9e48eff876cebebb69fa8

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        86a3369cdc8aee8921b10f5a9263ef522cdaea86

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3678c7a55d985699695a5bad7147c9f9114cd63126a49cc2c6ce2ccdd50dfb5d

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        22916699ea8ec50efdcafa7a6f4ef04a113d4261d7987eb426b752eff1846565530ae7396a2a2a8f9629adeff7421bcc3738e319fcabea8ad52767b1f4b5caba

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a48e5b020ac9e48eff876cebebb69fa8

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        86a3369cdc8aee8921b10f5a9263ef522cdaea86

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3678c7a55d985699695a5bad7147c9f9114cd63126a49cc2c6ce2ccdd50dfb5d

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        22916699ea8ec50efdcafa7a6f4ef04a113d4261d7987eb426b752eff1846565530ae7396a2a2a8f9629adeff7421bcc3738e319fcabea8ad52767b1f4b5caba

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a48e5b020ac9e48eff876cebebb69fa8

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        86a3369cdc8aee8921b10f5a9263ef522cdaea86

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3678c7a55d985699695a5bad7147c9f9114cd63126a49cc2c6ce2ccdd50dfb5d

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        22916699ea8ec50efdcafa7a6f4ef04a113d4261d7987eb426b752eff1846565530ae7396a2a2a8f9629adeff7421bcc3738e319fcabea8ad52767b1f4b5caba

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a48e5b020ac9e48eff876cebebb69fa8

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        86a3369cdc8aee8921b10f5a9263ef522cdaea86

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3678c7a55d985699695a5bad7147c9f9114cd63126a49cc2c6ce2ccdd50dfb5d

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        22916699ea8ec50efdcafa7a6f4ef04a113d4261d7987eb426b752eff1846565530ae7396a2a2a8f9629adeff7421bcc3738e319fcabea8ad52767b1f4b5caba

                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a48e5b020ac9e48eff876cebebb69fa8

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        86a3369cdc8aee8921b10f5a9263ef522cdaea86

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3678c7a55d985699695a5bad7147c9f9114cd63126a49cc2c6ce2ccdd50dfb5d

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        22916699ea8ec50efdcafa7a6f4ef04a113d4261d7987eb426b752eff1846565530ae7396a2a2a8f9629adeff7421bcc3738e319fcabea8ad52767b1f4b5caba

                                                                                                                                                                                                                      • C:\Program Files\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a6d7b8dda216eea182ec9d60000db30

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        77ffc4629ffde82413e2e4ecdd4ad7e381cd7720

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f7b539e9f398902ebbf1908661fff59b4e274d5f55c3f2efde89d10f008b8c56

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        5e2116ba4995989ae2fb203cfc64e543639a5e57b6cddc7879837abf7c8814bf82d4522ffc16d489c9314ebc9b4733d2991c678dd87c97be156c91ee8b5004f8

                                                                                                                                                                                                                      • C:\Program Files\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        4a6d7b8dda216eea182ec9d60000db30

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        77ffc4629ffde82413e2e4ecdd4ad7e381cd7720

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f7b539e9f398902ebbf1908661fff59b4e274d5f55c3f2efde89d10f008b8c56

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        5e2116ba4995989ae2fb203cfc64e543639a5e57b6cddc7879837abf7c8814bf82d4522ffc16d489c9314ebc9b4733d2991c678dd87c97be156c91ee8b5004f8

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\784939236\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        8774d5d2bf8f467b2ac04830d6ceb3b8

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        649bd5ddbb8712e0fbac3eda885787e137dc01a6

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        0847aab5f48f8b4dc26baa5c9102ae0ebfa1eccb23965efecc8f8ff21d07e650

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        3a33967ab07e8e093339a476d596478480a6be0be852ffdb846a4344b2fff25fd85e165e0de2115756fce7415052befa33e643b7b424014ae9b0e5d6ebd2017e

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\784939236\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        8774d5d2bf8f467b2ac04830d6ceb3b8

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        649bd5ddbb8712e0fbac3eda885787e137dc01a6

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        0847aab5f48f8b4dc26baa5c9102ae0ebfa1eccb23965efecc8f8ff21d07e650

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        3a33967ab07e8e093339a476d596478480a6be0be852ffdb846a4344b2fff25fd85e165e0de2115756fce7415052befa33e643b7b424014ae9b0e5d6ebd2017e

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f50c9c0474a7e9b94df148d677d4ed3d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        892546bd1868c8d8853c7b0150fd1bbaecc74a67

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        6de2a850566ec5ca50cb074fbd9805f23677a13b2cc60cee5af376fe9bf09db0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8a3a28bf054d843043351ecffca4cd00aabc6730ea14f0e9d458cc95ec9d7542a1fe8c3edd5db812e7043e29ade9371c57eeb33d8df81183d0c51cd3543f3dfc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        6e2444f1655dfe50dccb23b4694ca775

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        e4edf0ed9833319474c44242a041957335646461

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3098fd01ef76cfeaceb5fc0ffe66ecc09a0bfff49afe388ad54a9fbd7f92edd9

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        d579da65df28ebacc8d441f1033d10be9b6ebdb0dba6482de36c5fe27cbd7c8c35852f86023d7d13d09e0533717dffa52586bec264faf08d8eb016723719c5db

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        6e2444f1655dfe50dccb23b4694ca775

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        e4edf0ed9833319474c44242a041957335646461

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3098fd01ef76cfeaceb5fc0ffe66ecc09a0bfff49afe388ad54a9fbd7f92edd9

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        d579da65df28ebacc8d441f1033d10be9b6ebdb0dba6482de36c5fe27cbd7c8c35852f86023d7d13d09e0533717dffa52586bec264faf08d8eb016723719c5db

                                                                                                                                                                                                                      • C:\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        fd49d343359f54492cc6c83765c2c903

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        e6fa6959fb49196f32d7f2801012a78ef515fa53

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        effba0e71db9ea2f53fb85772416b173a8c48e637389678b183d1faad0b83f8a

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        df5cdb81a33ee1ad4f95c6e62940aa7ef7f9b2dd26c40c7dd4e93c43f33f4d7ca90b724223c554208d45fbfb5e6f27f02fec1869a97776dacc7deea9fafd39db

                                                                                                                                                                                                                      • C:\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        fd49d343359f54492cc6c83765c2c903

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        e6fa6959fb49196f32d7f2801012a78ef515fa53

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        effba0e71db9ea2f53fb85772416b173a8c48e637389678b183d1faad0b83f8a

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        df5cdb81a33ee1ad4f95c6e62940aa7ef7f9b2dd26c40c7dd4e93c43f33f4d7ca90b724223c554208d45fbfb5e6f27f02fec1869a97776dacc7deea9fafd39db

                                                                                                                                                                                                                      • C:\odt\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a809b49917633dfcccaa36b003cc1259

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        6d5dedeeb9cc8e1b9fd6a65f5ee1b985011fcac6

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        eaa9f3fee9cccff2c40525a26387ab803f3949166eaa1b4bc5bb456c6bd525b9

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        3dc7dad9a3164769c052874dabf108250674a8e2456cee724222945c0935705534e1a5ceab652113c2f5e432a9cc750c8649a0ee4892c0bac57d49279057359e

                                                                                                                                                                                                                      • C:\odt\backup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a809b49917633dfcccaa36b003cc1259

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        6d5dedeeb9cc8e1b9fd6a65f5ee1b985011fcac6

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        eaa9f3fee9cccff2c40525a26387ab803f3949166eaa1b4bc5bb456c6bd525b9

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        3dc7dad9a3164769c052874dabf108250674a8e2456cee724222945c0935705534e1a5ceab652113c2f5e432a9cc750c8649a0ee4892c0bac57d49279057359e