Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    177s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 01:39

General

  • Target

    9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe

  • Size

    72KB

  • MD5

    4dc5f4f3ad1f32baea7faaa56118a52e

  • SHA1

    6157b6e5cccc83fd401e8691f3b38b205e709113

  • SHA256

    9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2

  • SHA512

    0805f2a04f65c28dd9d1adb81d4158c6cb1d6d6153d48ee1c2b42092237a0132cd4d0dc4571346f2cfbcd9a743f78041613b124f564bb4ebcbae1c60bb5c5c45

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2+:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrC

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe
    "C:\Users\Admin\AppData\Local\Temp\9847b174e599e0c8e202e16150dfc385ad84b64471c66c1905aa88af32db3ef2.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5044
    • C:\Users\Admin\AppData\Local\Temp\1854180529\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1854180529\backup.exe C:\Users\Admin\AppData\Local\Temp\1854180529\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4320
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1776
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2828
        • C:\Program Files\update.exe
          "C:\Program Files\update.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3540
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4504
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1860
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2664
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1008
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4468
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1608
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:5096
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4996
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3224
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2920
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4144
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2928
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2020
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:332
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1968
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4904
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2732
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5100
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1088
                  • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                    C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                    9⤵
                      PID:3616
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4464
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                    8⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4228
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4236
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3776
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:360
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4124
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                      9⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1316
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1868
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4864
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1528
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                      9⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1800
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:472
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:5088
                  • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2096
                  • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                    8⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3696
                  • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                    8⤵
                      PID:3648
                    • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                      8⤵
                        PID:4556
                      • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:380
                      • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\data.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                        8⤵
                          PID:436
                        • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                          8⤵
                            PID:820
                          • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • System policy modification
                            PID:1012
                          • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\update.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\update.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:2632
                          • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                            8⤵
                              PID:424
                            • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                              8⤵
                                PID:908
                              • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                                8⤵
                                  PID:4436
                                • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                                  8⤵
                                    PID:4960
                                  • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                                    8⤵
                                      PID:920
                                    • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                                      8⤵
                                        PID:760
                                        • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                          "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                          9⤵
                                          • System policy modification
                                          PID:4676
                                          • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe
                                            "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                            10⤵
                                              PID:5008
                                        • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                                          8⤵
                                            PID:3268
                                          • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                                            8⤵
                                              PID:4632
                                            • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\data.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\data.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                                              8⤵
                                              • System policy modification
                                              PID:1460
                                            • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:4220
                                            • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                                              8⤵
                                                PID:4124
                                              • C:\Program Files\Common Files\microsoft shared\ink\th-TH\System Restore.exe
                                                "C:\Program Files\Common Files\microsoft shared\ink\th-TH\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                                                8⤵
                                                  PID:212
                                                • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                                                  8⤵
                                                    PID:3360
                                                  • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System policy modification
                                                    PID:5052
                                                  • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                                                    8⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:3776
                                                  • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\System Restore.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                                                    8⤵
                                                      PID:1380
                                                    • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                                                      8⤵
                                                        PID:5016
                                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                                      7⤵
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3756
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                                        8⤵
                                                          PID:5080
                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                                          8⤵
                                                            PID:2940
                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                                            8⤵
                                                              PID:2872
                                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                                              8⤵
                                                                PID:3056
                                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                                                "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                                                8⤵
                                                                  PID:2296
                                                                • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                                                  8⤵
                                                                  • System policy modification
                                                                  PID:3972
                                                              • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                                                "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                                                7⤵
                                                                  PID:4804
                                                                • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                  "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                                                  7⤵
                                                                    PID:2092
                                                                  • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                                                    "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                                                    7⤵
                                                                      PID:3476
                                                                    • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                                                      "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                                                      7⤵
                                                                        PID:5040
                                                                      • C:\Program Files\Common Files\microsoft shared\TextConv\System Restore.exe
                                                                        "C:\Program Files\Common Files\microsoft shared\TextConv\System Restore.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                                                        7⤵
                                                                          PID:176
                                                                          • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                                                            "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                                            8⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:3724
                                                                        • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                                                          "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                                                          7⤵
                                                                          • System policy modification
                                                                          PID:3940
                                                                          • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\System Restore.exe
                                                                            "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\System Restore.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                                            8⤵
                                                                              PID:3080
                                                                          • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                                                            "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                                                            7⤵
                                                                              PID:4860
                                                                            • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                                                              "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                                                              7⤵
                                                                                PID:5100
                                                                                • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                                                  "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                                                  8⤵
                                                                                    PID:4996
                                                                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                                                      9⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:4424
                                                                                • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                                                                  "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                                                                  7⤵
                                                                                  • System policy modification
                                                                                  PID:3184
                                                                              • C:\Program Files\Common Files\Services\backup.exe
                                                                                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                                                6⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4240
                                                                              • C:\Program Files\Common Files\System\backup.exe
                                                                                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                                                6⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Program Files directory
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4356
                                                                                • C:\Program Files\Common Files\System\ado\backup.exe
                                                                                  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                                                  7⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Program Files directory
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1860
                                                                                  • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                                                    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                                                    8⤵
                                                                                      PID:2996
                                                                                    • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                                                      "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                                                      8⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:4300
                                                                                    • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                                                      "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                                                      8⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:4452
                                                                                    • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                                                      "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                                                      8⤵
                                                                                        PID:1772
                                                                                      • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                                                        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                                                        8⤵
                                                                                          PID:1320
                                                                                        • C:\Program Files\Common Files\System\ado\it-IT\System Restore.exe
                                                                                          "C:\Program Files\Common Files\System\ado\it-IT\System Restore.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                                                          8⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          PID:4780
                                                                                      • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                                                        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                                                        7⤵
                                                                                          PID:3504
                                                                                        • C:\Program Files\Common Files\System\en-US\backup.exe
                                                                                          "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                                                          7⤵
                                                                                            PID:3268
                                                                                          • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                                                            "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                                                            7⤵
                                                                                              PID:3776
                                                                                            • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                                                              "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                                              7⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:2204
                                                                                            • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                                              "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                                              7⤵
                                                                                                PID:3160
                                                                                              • C:\Program Files\Common Files\System\ja-JP\update.exe
                                                                                                "C:\Program Files\Common Files\System\ja-JP\update.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                                                7⤵
                                                                                                  PID:4808
                                                                                                • C:\Program Files\Common Files\System\msadc\backup.exe
                                                                                                  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                                                                  7⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:1984
                                                                                                • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                                                  "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                                                  7⤵
                                                                                                    PID:4872
                                                                                                    • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                                                      "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                                                      8⤵
                                                                                                        PID:4288
                                                                                                      • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                                                        "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                                                        8⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        PID:4956
                                                                                                      • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                                                        "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                                                        8⤵
                                                                                                        • System policy modification
                                                                                                        PID:4040
                                                                                                      • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                                                        "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                                                        8⤵
                                                                                                        • System policy modification
                                                                                                        PID:4116
                                                                                                      • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                                                        "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                                                        8⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        PID:1056
                                                                                                      • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                                                        "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                                                        8⤵
                                                                                                          PID:3080
                                                                                                  • C:\Program Files\Google\backup.exe
                                                                                                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4488
                                                                                                    • C:\Program Files\Google\Chrome\backup.exe
                                                                                                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                                                      6⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:388
                                                                                                      • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                                                        7⤵
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:4276
                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                                          8⤵
                                                                                                          • Drops file in Program Files directory
                                                                                                          PID:4216
                                                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                                            9⤵
                                                                                                              PID:2188
                                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                                              9⤵
                                                                                                                PID:2216
                                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                                                9⤵
                                                                                                                  PID:5016
                                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                                                  9⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:1716
                                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                                                  9⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  PID:4820
                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                                                    10⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • System policy modification
                                                                                                                    PID:1128
                                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                                      11⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      PID:3320
                                                                                                              • C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\SetupMetrics\data.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                                                8⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                PID:1536
                                                                                                        • C:\Program Files\Internet Explorer\backup.exe
                                                                                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:3900
                                                                                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                                            6⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            PID:4680
                                                                                                          • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                                            "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                                            6⤵
                                                                                                              PID:4596
                                                                                                            • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                                              "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                                              6⤵
                                                                                                                PID:5044
                                                                                                              • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                                                "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                                                6⤵
                                                                                                                  PID:1428
                                                                                                                • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                                                  "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                                                  6⤵
                                                                                                                    PID:2436
                                                                                                                  • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                                                    "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                                                    6⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    PID:3372
                                                                                                                  • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                                                    "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                                                    6⤵
                                                                                                                      PID:2164
                                                                                                                    • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                                                      "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                                                      6⤵
                                                                                                                        PID:4756
                                                                                                                    • C:\Program Files\Java\backup.exe
                                                                                                                      "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                                                      5⤵
                                                                                                                        PID:548
                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                                                          6⤵
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          PID:4540
                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                                                            7⤵
                                                                                                                              PID:1456
                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                                                                8⤵
                                                                                                                                  PID:4048
                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                                                  8⤵
                                                                                                                                    PID:3752
                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                                                                  7⤵
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  PID:4144
                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                                                    8⤵
                                                                                                                                      PID:1216
                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                                                    7⤵
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    • System policy modification
                                                                                                                                    PID:3144
                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                                                      8⤵
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      PID:2180
                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                                                        9⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        PID:4564
                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe
                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                                                                        9⤵
                                                                                                                                          PID:608
                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\update.exe
                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\update.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                                                                          9⤵
                                                                                                                                            PID:4744
                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                                                                          8⤵
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:4320
                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe
                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\
                                                                                                                                            9⤵
                                                                                                                                              PID:3088
                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe
                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\
                                                                                                                                              9⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              PID:952
                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe
                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\
                                                                                                                                              9⤵
                                                                                                                                                PID:2644
                                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\backup.exe
                                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\
                                                                                                                                                9⤵
                                                                                                                                                  PID:4396
                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe
                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\
                                                                                                                                                  9⤵
                                                                                                                                                    PID:3460
                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\backup.exe
                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\
                                                                                                                                                    9⤵
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:4924
                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\backup.exe
                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\
                                                                                                                                                    9⤵
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:3848
                                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\backup.exe
                                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\
                                                                                                                                                      10⤵
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:4640
                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\backup.exe
                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\
                                                                                                                                                    9⤵
                                                                                                                                                      PID:4944
                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe
                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                                                                                                  7⤵
                                                                                                                                                    PID:4556
                                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe
                                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\
                                                                                                                                                      8⤵
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      PID:4240
                                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe
                                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\
                                                                                                                                                        9⤵
                                                                                                                                                          PID:4344
                                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
                                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
                                                                                                                                                            10⤵
                                                                                                                                                              PID:936
                                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
                                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\
                                                                                                                                                              10⤵
                                                                                                                                                                PID:2664
                                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe
                                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\
                                                                                                                                                              9⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:4472
                                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe
                                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\
                                                                                                                                                              9⤵
                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                              PID:3104
                                                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\update.exe
                                                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\update.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
                                                                                                                                                                10⤵
                                                                                                                                                                  PID:3608
                                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
                                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
                                                                                                                                                                  10⤵
                                                                                                                                                                    PID:1676
                                                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                                                                            6⤵
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            PID:5080
                                                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\lib\backup.exe
                                                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\lib\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\
                                                                                                                                                              7⤵
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:1128
                                                                                                                                                              • C:\Program Files\Java\jre1.8.0_66\lib\amd64\backup.exe
                                                                                                                                                                "C:\Program Files\Java\jre1.8.0_66\lib\amd64\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\amd64\
                                                                                                                                                                8⤵
                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:3320
                                                                                                                                                              • C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe
                                                                                                                                                                "C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\applet\
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:3420
                                                                                                                                                                • C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe
                                                                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\cmm\
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:1012
                                                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe
                                                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\deploy\
                                                                                                                                                                    8⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:2960
                                                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\ext\backup.exe
                                                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\ext\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\ext\
                                                                                                                                                                    8⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    PID:4648
                                                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe
                                                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\fonts\
                                                                                                                                                                    8⤵
                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                    PID:4944
                                                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\images\backup.exe
                                                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\images\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\images\
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:1596
                                                                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\System Restore.exe
                                                                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\System Restore.exe" C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:4680
                                                                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\lib\jfr\backup.exe
                                                                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\lib\jfr\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\jfr\
                                                                                                                                                                        8⤵
                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                        PID:2340
                                                                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\lib\management\backup.exe
                                                                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\lib\management\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\management\
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:1840
                                                                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\data.exe
                                                                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\data.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:4036
                                                                                                                                                                    • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                                                                      "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      PID:4608
                                                                                                                                                                      • C:\Program Files\Microsoft Office\PackageManifests\data.exe
                                                                                                                                                                        "C:\Program Files\Microsoft Office\PackageManifests\data.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:2248
                                                                                                                                                                        • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                                                                                                          "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          PID:3456
                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                                                                                            "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                            PID:4500
                                                                                                                                                                            • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                                                                                                                              "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:4984
                                                                                                                                                                              • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                                                                                                                "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:3932
                                                                                                                                                                                • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\update.exe
                                                                                                                                                                                  "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\update.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:3976
                                                                                                                                                                              • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                                                                                                                "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                                                                                                7⤵
                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                PID:4448
                                                                                                                                                                              • C:\Program Files\Microsoft Office\root\fre\backup.exe
                                                                                                                                                                                "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:4900
                                                                                                                                                                                • C:\Program Files\Microsoft Office\root\Integration\backup.exe
                                                                                                                                                                                  "C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  PID:4864
                                                                                                                                                                                  • C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe
                                                                                                                                                                                    "C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                    PID:2000
                                                                                                                                                                                • C:\Program Files\Microsoft Office\root\Licenses\backup.exe
                                                                                                                                                                                  "C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:4512
                                                                                                                                                                                  • C:\Program Files\Microsoft Office\root\Licenses16\backup.exe
                                                                                                                                                                                    "C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:4360
                                                                                                                                                                                    • C:\Program Files\Microsoft Office\root\loc\backup.exe
                                                                                                                                                                                      "C:\Program Files\Microsoft Office\root\loc\backup.exe" C:\Program Files\Microsoft Office\root\loc\
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:4660
                                                                                                                                                                                      • C:\Program Files\Microsoft Office\root\Office15\backup.exe
                                                                                                                                                                                        "C:\Program Files\Microsoft Office\root\Office15\backup.exe" C:\Program Files\Microsoft Office\root\Office15\
                                                                                                                                                                                        7⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        PID:920
                                                                                                                                                                                      • C:\Program Files\Microsoft Office\root\Office16\backup.exe
                                                                                                                                                                                        "C:\Program Files\Microsoft Office\root\Office16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\
                                                                                                                                                                                        7⤵
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:4804
                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Office16\data.exe
                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Office16\data.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:4848
                                                                                                                                                                                      • C:\Program Files\Microsoft Office\Updates\backup.exe
                                                                                                                                                                                        "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        PID:2160
                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Updates\Apply\backup.exe
                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:4388
                                                                                                                                                                                            • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe
                                                                                                                                                                                              "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\
                                                                                                                                                                                              8⤵
                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                              PID:4804
                                                                                                                                                                                              • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\E3689E5E-425C-46DC-95FC-E48F726723DE\backup.exe
                                                                                                                                                                                                "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\E3689E5E-425C-46DC-95FC-E48F726723DE\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\E3689E5E-425C-46DC-95FC-E48F726723DE\
                                                                                                                                                                                                9⤵
                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                PID:2180
                                                                                                                                                                                          • C:\Program Files\Microsoft Office\Updates\Download\backup.exe
                                                                                                                                                                                            "C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:2364
                                                                                                                                                                                              • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe
                                                                                                                                                                                                "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                PID:520
                                                                                                                                                                                                • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\backup.exe
                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                  PID:1240
                                                                                                                                                                                                  • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\System Restore.exe
                                                                                                                                                                                                    "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\System Restore.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\
                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                      • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\vfs\backup.exe
                                                                                                                                                                                                        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\vfs\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\vfs\
                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                        PID:1488
                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\vfs\Windows\backup.exe
                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\vfs\Windows\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E3689E5E-425C-46DC-95FC-E48F726723DE\root\vfs\Windows\
                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                            PID:2824
                                                                                                                                                                                            • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                                                                                                              "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                              PID:5112
                                                                                                                                                                                              • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                                                                                                                                                "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                PID:3672
                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\update.exe
                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\update.exe" C:\Program Files\Mozilla Firefox\
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                              PID:1548
                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:1296
                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\backup.exe
                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:2204
                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\defaults\backup.exe
                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:2872
                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:4476
                                                                                                                                                                                                    • C:\Program Files (x86)\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:4444
                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:1140
                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                          PID:2000
                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:984
                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:4764
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:820
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:3620
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:2228
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                PID:868
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  PID:628
                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                      PID:4572
                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:1380
                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                      PID:1984
                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                        PID:2220
                                                                                                                                                                                                                      • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                                                                                                                                                                        "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                          PID:3824
                                                                                                                                                                                                                        • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                                                                                                                                                                          "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                          PID:2340
                                                                                                                                                                                                                        • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                                                                                                                                                                          "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                            PID:2160
                                                                                                                                                                                                                          • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                                                                                                                                                                            "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                              PID:4372
                                                                                                                                                                                                                            • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                                                                                                                                                                              "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                PID:1768
                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                                              • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                                                                                                                                                                                                "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                  PID:3528
                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                  PID:176
                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                      PID:820
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                        PID:3696
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                          PID:3268
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                            PID:1768
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                            PID:660
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                            PID:332
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                PID:4820
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                PID:5040
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:3184
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                      PID:2404
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        PID:3616
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                            PID:3140
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                PID:2180
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\
                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                  PID:3916
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\
                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                      PID:5108
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:2432
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:3480
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              PID:2928
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                              PID:2440
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                              PID:3316
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                            PID:4124
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              PID:3932
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:3700
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:1596
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                              PID:2660
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                PID:1264
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                              PID:4964
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                  PID:1204
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Java\data.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Java\data.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                              PID:4404
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:2116
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\update.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                PID:868
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:876
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\update.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                          PID:2204
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                            PID:4232
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:3916
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\
                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                              PID:260
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\
                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                PID:2920
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                  PID:4220
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\
                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                PID:4808
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                    PID:4744
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\
                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                      PID:1840
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                    PID:4032
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\data.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                      PID:2732
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\
                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                          PID:4404
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\data.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\
                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:1980
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                            PID:3676
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                        PID:1276
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:2260
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\System\ado\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                            PID:1984
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                              PID:2824
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                PID:3420
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                                  PID:2932
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\System\ado\ja-JP\
                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                    PID:3688
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\System\de-DE\backup.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\System\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\de-DE\
                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                    PID:3664
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                PID:3056
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Google\CrashReports\System Restore.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Google\CrashReports\System Restore.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                      PID:2228
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Temp\update.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Temp\update.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                        PID:1968
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                        PID:1284
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                            PID:4680
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                              PID:760
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                PID:4040
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Google\Update\Install\{9FE34FF4-CC04-4D7E-96B4-2FFAA3FF5050}\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Google\Update\Install\{9FE34FF4-CC04-4D7E-96B4-2FFAA3FF5050}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{9FE34FF4-CC04-4D7E-96B4-2FFAA3FF5050}\
                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                    PID:1008
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Google\Update\Offline\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                              PID:3580
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\images\backup.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                  PID:688
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                                                  PID:952
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                    PID:2164
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:4828
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:2700
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:396
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:1464
                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\backup.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:1140
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                PID:2816
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                  PID:3604
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                      PID:1360
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                        PID:2336
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\
                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                            PID:1008
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\data.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\data.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\
                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\
                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                            PID:3776
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft.NET\backup.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:3940
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                          PID:4464
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:5004
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\logs\
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                                              PID:3204
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\MSBuild\backup.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            PID:4500
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\MSBuild\Microsoft\backup.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\MSBuild\Microsoft\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                              PID:2440
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\
                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                PID:424
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\backup.exe" C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4580
                                                                                                                                                                                                                                                                                                                                          • C:\Users\backup.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                            PID:3664
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                PID:4288
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2828
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Links\data.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Links\data.exe C:\Users\Admin\Links\
                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    PID:4840
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2944
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1356
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4132
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\data.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Pictures\data.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1488
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Saved Pictures\System Restore.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Saved Pictures\System Restore.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                                                              PID:2948
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2156
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3624
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\backup.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:824
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:536
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4584
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                                                        PID:4168
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\backup.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:4668
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\addins\backup.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1356
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\appcompat\backup.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                                                        PID:4344
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5032
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1488
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:1088
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2020
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4216
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\apppatch\en-US\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3020
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\Custom\update.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\Custom\update.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:4696
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\AppPatch64\data.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\AppPatch64\data.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                    PID:3424
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\es-ES\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                    PID:3280
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\it-IT\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\apppatch\ja-JP\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\
                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\AppReadiness\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                      PID:3432
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\assembly\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:1776
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                        PID:1376
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\assembly\GAC\ADODB\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\assembly\GAC\Extensibility\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:4832
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1768
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\assembly\GAC\Microsoft.mshtml\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\
                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                              PID:2296
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\assembly\GAC\Microsoft.StdFormat\backup.exe C:\Windows\assembly\GAC\Microsoft.StdFormat\
                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4300
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\bcastdvr\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\
                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:1092
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                      PID:2888
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                      PID:212
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                      PID:2192
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                      PID:3592
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                      PID:2476
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4164
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4640
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4832
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                              PID:1768
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4232
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:956
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\data.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\
                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\
                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\
                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\
                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\
                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\
                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\
                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\
                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\
                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:504
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\data.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\data.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1688

                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          336bb694a73abd6e13201e271397f661

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          e78e1c2e016335a601828deab8f603f5aed75208

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          e9b9eb9df39a5858226d8daf5c5677f2cca4376a9ac5c59ce43a055db22b5ff5

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          3d18365912e5874f5268b20fff231c0fcfc81218afe204db267f230da97f6b7440365376b89f964fca0c12cd33b0fe842f493187dd403accfcbf177d119f7f8e

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          336bb694a73abd6e13201e271397f661

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          e78e1c2e016335a601828deab8f603f5aed75208

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          e9b9eb9df39a5858226d8daf5c5677f2cca4376a9ac5c59ce43a055db22b5ff5

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          3d18365912e5874f5268b20fff231c0fcfc81218afe204db267f230da97f6b7440365376b89f964fca0c12cd33b0fe842f493187dd403accfcbf177d119f7f8e

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          980ce17da44cfc5a1f4cc7a57f8fc7d0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          0cb2e4a941279f7dd770038573952a33e10fd321

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          2fdededbac5b7f272a02abe8138b5bd609c7b91355230d1cbe090fe67622f60f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          f32599e6968d0dbf7527e14e17daacd12b1e600f0cfb8797b45c16dcf9b19e26190de8d4eefde7892aec53783b441d9df27805e4987684dab8cf1ff3377e08c7

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          980ce17da44cfc5a1f4cc7a57f8fc7d0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          0cb2e4a941279f7dd770038573952a33e10fd321

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          2fdededbac5b7f272a02abe8138b5bd609c7b91355230d1cbe090fe67622f60f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          f32599e6968d0dbf7527e14e17daacd12b1e600f0cfb8797b45c16dcf9b19e26190de8d4eefde7892aec53783b441d9df27805e4987684dab8cf1ff3377e08c7

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          639c361c00442ce6689cbd6d547b02a4

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          7cc686eb993de67cccd1644745f025948e70a805

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          daecec297482ede28790ecf10f5b2f63da4500e079cc6a5d746736053df182f8

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          c8de77192b40caf31fb268a02f73d48767e4a6f75dfba247a96f48b3048238d1adfeaa5752764a07ca966e32488d629a52e607c182f078fbd0703c873036acfa

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          639c361c00442ce6689cbd6d547b02a4

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          7cc686eb993de67cccd1644745f025948e70a805

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          daecec297482ede28790ecf10f5b2f63da4500e079cc6a5d746736053df182f8

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          c8de77192b40caf31fb268a02f73d48767e4a6f75dfba247a96f48b3048238d1adfeaa5752764a07ca966e32488d629a52e607c182f078fbd0703c873036acfa

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          0619c7042e92dfb0e283c985a834a0a7

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          186cecf039338d82b12247a63ae634c3dc2a69c9

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          32ab17eddc2ff743399f801d92e73cf82f5f1b505abacebb87ae683f110d2008

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          03f36a259a50abe9d691b338a8ad377ae239bf863f1d7254387d05eab6505360299dd7d4c41f420cdbc73159fba20650489e4c1ad48ea810509ab89da52d1aa9

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          0619c7042e92dfb0e283c985a834a0a7

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          186cecf039338d82b12247a63ae634c3dc2a69c9

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          32ab17eddc2ff743399f801d92e73cf82f5f1b505abacebb87ae683f110d2008

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          03f36a259a50abe9d691b338a8ad377ae239bf863f1d7254387d05eab6505360299dd7d4c41f420cdbc73159fba20650489e4c1ad48ea810509ab89da52d1aa9

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          985c7af38de8d953dfdfea47d432c627

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          ab8d26d86940c74e922647e067e7654b0456d3ad

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          34e80dbc5ae49a00c1761b5360220936a75fea40a255ffd066e3077afb10becb

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          91ec78f5919810ba8573228a6f27b7e511cc5a49f2bcda1bb25768fde05bfe0657c77055b42e08987765695238c977dd62fa1d94fa592e96475c0fb9ef3e9ce5

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          985c7af38de8d953dfdfea47d432c627

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          ab8d26d86940c74e922647e067e7654b0456d3ad

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          34e80dbc5ae49a00c1761b5360220936a75fea40a255ffd066e3077afb10becb

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          91ec78f5919810ba8573228a6f27b7e511cc5a49f2bcda1bb25768fde05bfe0657c77055b42e08987765695238c977dd62fa1d94fa592e96475c0fb9ef3e9ce5

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          4baa2693eea825e3ad71faa4cc1e6f3a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          6dbb430fed0ba1fc04924114880b2da9b8b20bc0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          a3f9df3af7db1288fd2cf4462c1ca094e506f97bafe67ab5802b7401685832b0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          c351cc5e0716dc5ec63eea2b4f580cd036b46db0948944156a82e9feb3d4f93c62e7e2acc6b65faba6ca344d11ec597bda631023033bf5b6540b99547c9c73b4

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          4baa2693eea825e3ad71faa4cc1e6f3a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          6dbb430fed0ba1fc04924114880b2da9b8b20bc0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          a3f9df3af7db1288fd2cf4462c1ca094e506f97bafe67ab5802b7401685832b0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          c351cc5e0716dc5ec63eea2b4f580cd036b46db0948944156a82e9feb3d4f93c62e7e2acc6b65faba6ca344d11ec597bda631023033bf5b6540b99547c9c73b4

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          0619c7042e92dfb0e283c985a834a0a7

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          186cecf039338d82b12247a63ae634c3dc2a69c9

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          32ab17eddc2ff743399f801d92e73cf82f5f1b505abacebb87ae683f110d2008

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          03f36a259a50abe9d691b338a8ad377ae239bf863f1d7254387d05eab6505360299dd7d4c41f420cdbc73159fba20650489e4c1ad48ea810509ab89da52d1aa9

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          0619c7042e92dfb0e283c985a834a0a7

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          186cecf039338d82b12247a63ae634c3dc2a69c9

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          32ab17eddc2ff743399f801d92e73cf82f5f1b505abacebb87ae683f110d2008

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          03f36a259a50abe9d691b338a8ad377ae239bf863f1d7254387d05eab6505360299dd7d4c41f420cdbc73159fba20650489e4c1ad48ea810509ab89da52d1aa9

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          ffa219b9b5f487961ac56544d32e860f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          272dc05d951dafe4b414a6c9c15615772b4b1fee

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          6c9c6e27d98608a8b78db86f35963e24aad0700330165152d3de70839f3338dd

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          181609e9847ae4588a20951adb3ce980d7bb83c202bcd21bf32902f3872cb617fe4d143a9983a0d5740dd40d41cc725c82ebcd34f4f550626b5d051cb1f4c903

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          ffa219b9b5f487961ac56544d32e860f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          272dc05d951dafe4b414a6c9c15615772b4b1fee

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          6c9c6e27d98608a8b78db86f35963e24aad0700330165152d3de70839f3338dd

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          181609e9847ae4588a20951adb3ce980d7bb83c202bcd21bf32902f3872cb617fe4d143a9983a0d5740dd40d41cc725c82ebcd34f4f550626b5d051cb1f4c903

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          4baa2693eea825e3ad71faa4cc1e6f3a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          6dbb430fed0ba1fc04924114880b2da9b8b20bc0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          a3f9df3af7db1288fd2cf4462c1ca094e506f97bafe67ab5802b7401685832b0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          c351cc5e0716dc5ec63eea2b4f580cd036b46db0948944156a82e9feb3d4f93c62e7e2acc6b65faba6ca344d11ec597bda631023033bf5b6540b99547c9c73b4

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          4baa2693eea825e3ad71faa4cc1e6f3a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          6dbb430fed0ba1fc04924114880b2da9b8b20bc0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          a3f9df3af7db1288fd2cf4462c1ca094e506f97bafe67ab5802b7401685832b0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          c351cc5e0716dc5ec63eea2b4f580cd036b46db0948944156a82e9feb3d4f93c62e7e2acc6b65faba6ca344d11ec597bda631023033bf5b6540b99547c9c73b4

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          ffa219b9b5f487961ac56544d32e860f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          272dc05d951dafe4b414a6c9c15615772b4b1fee

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          6c9c6e27d98608a8b78db86f35963e24aad0700330165152d3de70839f3338dd

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          181609e9847ae4588a20951adb3ce980d7bb83c202bcd21bf32902f3872cb617fe4d143a9983a0d5740dd40d41cc725c82ebcd34f4f550626b5d051cb1f4c903

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          ffa219b9b5f487961ac56544d32e860f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          272dc05d951dafe4b414a6c9c15615772b4b1fee

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          6c9c6e27d98608a8b78db86f35963e24aad0700330165152d3de70839f3338dd

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          181609e9847ae4588a20951adb3ce980d7bb83c202bcd21bf32902f3872cb617fe4d143a9983a0d5740dd40d41cc725c82ebcd34f4f550626b5d051cb1f4c903

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          ffa219b9b5f487961ac56544d32e860f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          272dc05d951dafe4b414a6c9c15615772b4b1fee

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          6c9c6e27d98608a8b78db86f35963e24aad0700330165152d3de70839f3338dd

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          181609e9847ae4588a20951adb3ce980d7bb83c202bcd21bf32902f3872cb617fe4d143a9983a0d5740dd40d41cc725c82ebcd34f4f550626b5d051cb1f4c903

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          ffa219b9b5f487961ac56544d32e860f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          272dc05d951dafe4b414a6c9c15615772b4b1fee

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          6c9c6e27d98608a8b78db86f35963e24aad0700330165152d3de70839f3338dd

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          181609e9847ae4588a20951adb3ce980d7bb83c202bcd21bf32902f3872cb617fe4d143a9983a0d5740dd40d41cc725c82ebcd34f4f550626b5d051cb1f4c903

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          2d3e1f99aefb23af7fea4d3f788b7f1a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          b8d0ef0a2549fee8b545021f5974286a0db91b00

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          8b644221e6b9310bab3d08fd0b9e8df429ad7d7a7ec0691a9f4df9ce378550a2

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          44a9eb9c0226d43447633fead007e0628165719237afb34299c0e2a098f1091ccf8150b5bcc56532de90945e74c740d676bdbfe63ec6fc8059aecb43a0735a7f

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          2d3e1f99aefb23af7fea4d3f788b7f1a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          b8d0ef0a2549fee8b545021f5974286a0db91b00

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          8b644221e6b9310bab3d08fd0b9e8df429ad7d7a7ec0691a9f4df9ce378550a2

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          44a9eb9c0226d43447633fead007e0628165719237afb34299c0e2a098f1091ccf8150b5bcc56532de90945e74c740d676bdbfe63ec6fc8059aecb43a0735a7f

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          3ac5c67eca7779434cadceb32072366f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          722b1a1bf1e44875618ed9ee1fe6c8e043034c30

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          9926e2aa6ce6c15a90312f2e2b1ce8cbf4ec965c7c3918ac4ca9d41bf577e82e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          2fbeb3208ab362e3e85d6ba8fe4486f0a9c1a5eecba33c56d99b4c363ce6ffee3d70a8dceb70720fe1d266b01afb1f1952e910393cc231c75d4ab0944034c7c3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          3ac5c67eca7779434cadceb32072366f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          722b1a1bf1e44875618ed9ee1fe6c8e043034c30

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          9926e2aa6ce6c15a90312f2e2b1ce8cbf4ec965c7c3918ac4ca9d41bf577e82e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          2fbeb3208ab362e3e85d6ba8fe4486f0a9c1a5eecba33c56d99b4c363ce6ffee3d70a8dceb70720fe1d266b01afb1f1952e910393cc231c75d4ab0944034c7c3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          3ac5c67eca7779434cadceb32072366f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          722b1a1bf1e44875618ed9ee1fe6c8e043034c30

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          9926e2aa6ce6c15a90312f2e2b1ce8cbf4ec965c7c3918ac4ca9d41bf577e82e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          2fbeb3208ab362e3e85d6ba8fe4486f0a9c1a5eecba33c56d99b4c363ce6ffee3d70a8dceb70720fe1d266b01afb1f1952e910393cc231c75d4ab0944034c7c3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          3ac5c67eca7779434cadceb32072366f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          722b1a1bf1e44875618ed9ee1fe6c8e043034c30

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          9926e2aa6ce6c15a90312f2e2b1ce8cbf4ec965c7c3918ac4ca9d41bf577e82e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          2fbeb3208ab362e3e85d6ba8fe4486f0a9c1a5eecba33c56d99b4c363ce6ffee3d70a8dceb70720fe1d266b01afb1f1952e910393cc231c75d4ab0944034c7c3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          3ac5c67eca7779434cadceb32072366f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          722b1a1bf1e44875618ed9ee1fe6c8e043034c30

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          9926e2aa6ce6c15a90312f2e2b1ce8cbf4ec965c7c3918ac4ca9d41bf577e82e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          2fbeb3208ab362e3e85d6ba8fe4486f0a9c1a5eecba33c56d99b4c363ce6ffee3d70a8dceb70720fe1d266b01afb1f1952e910393cc231c75d4ab0944034c7c3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          3ac5c67eca7779434cadceb32072366f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          722b1a1bf1e44875618ed9ee1fe6c8e043034c30

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          9926e2aa6ce6c15a90312f2e2b1ce8cbf4ec965c7c3918ac4ca9d41bf577e82e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          2fbeb3208ab362e3e85d6ba8fe4486f0a9c1a5eecba33c56d99b4c363ce6ffee3d70a8dceb70720fe1d266b01afb1f1952e910393cc231c75d4ab0944034c7c3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          191348dedee042a4af491e0988d6c889

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          8ef957a4e419092498abab2ac734c6f6eaa7cf5d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          810734ebba9016a5ed12212f92dff05873cf0140108cd4f55e8282003f659e74

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          e4218ba5b5b765f344610f2b72360e2e912ea98219619cf3b500161733c5928549f8e4ccbc1584a202b783791619c08c50b53a361b323fda22bb836c8e536ab1

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          2dc01711252677f9bf641c0c680762e3

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          9cef07c85a3546f767e53cbc7abb3c7d255f2a64

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          69c9ebecc4065fd575cb077b33a70d75b76ed23cc59556f8f066767ed04dbf0f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          3c1f1fbaa448d923cba9105fc81c8c701506f09b6dc284c94ad901032615b5f328aabcc50ec0c2d90b49953640836d5a888ecca1ec09ea6c06d513f3a5a40773

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          2dc01711252677f9bf641c0c680762e3

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          9cef07c85a3546f767e53cbc7abb3c7d255f2a64

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          69c9ebecc4065fd575cb077b33a70d75b76ed23cc59556f8f066767ed04dbf0f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          3c1f1fbaa448d923cba9105fc81c8c701506f09b6dc284c94ad901032615b5f328aabcc50ec0c2d90b49953640836d5a888ecca1ec09ea6c06d513f3a5a40773

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          948e731014dea3a00fbd3232559986d0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          2bd8a8f4f3b488f014eb8a95156a5da321dc0a77

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          ec13abbe642f1af6d63b3f8e85421668fe6a0200fe4adacc644b21e639fd02c1

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          6f805e5d87f2329d8b4c410518f883f2a0c334713e6a80bf061923c0a32c7c5330404d5dac50d11fdde2134e0d0d7034dae5def42e12255da764cc55f99961c3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          948e731014dea3a00fbd3232559986d0

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          2bd8a8f4f3b488f014eb8a95156a5da321dc0a77

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          ec13abbe642f1af6d63b3f8e85421668fe6a0200fe4adacc644b21e639fd02c1

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          6f805e5d87f2329d8b4c410518f883f2a0c334713e6a80bf061923c0a32c7c5330404d5dac50d11fdde2134e0d0d7034dae5def42e12255da764cc55f99961c3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\update.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          8890c4574058350bfefd65e89ee35a89

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          ccb95f72fbcaf3e4b96a5fd4673f023813bbcd92

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          3c5ce9d7a904fabbf6fd9f2146260b90a8e82029a1e3cef0273808c9ca0429e8

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          a0a1dc95315e7acff6044cd7958ba2153ecfb1817330c9ace9bfee76153e5f2535ac33f04641cc0294c58e4062f99dda8b6904b6ada350533c619cb1b6b1b9d3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\update.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          8890c4574058350bfefd65e89ee35a89

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          ccb95f72fbcaf3e4b96a5fd4673f023813bbcd92

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          3c5ce9d7a904fabbf6fd9f2146260b90a8e82029a1e3cef0273808c9ca0429e8

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          a0a1dc95315e7acff6044cd7958ba2153ecfb1817330c9ace9bfee76153e5f2535ac33f04641cc0294c58e4062f99dda8b6904b6ada350533c619cb1b6b1b9d3

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1854180529\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          c55d7b447e78be891df0534022dd4a76

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          2d0ffbd2f69eead46ff31086492d8437f52c223f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          e58d90bcb7a2db2ffd47f719fedb0676eadc142984b9a5a50c99d29d9538da3d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          723e1ffe477fa0029d2c3540618dbcffb5d1297d8ea80e514657582ff797c54f335bdb0b7eae8c441cfa12b667e192e5fe4db0c28c770cca839b8379fbe232c4

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1854180529\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          c55d7b447e78be891df0534022dd4a76

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          2d0ffbd2f69eead46ff31086492d8437f52c223f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          e58d90bcb7a2db2ffd47f719fedb0676eadc142984b9a5a50c99d29d9538da3d

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          723e1ffe477fa0029d2c3540618dbcffb5d1297d8ea80e514657582ff797c54f335bdb0b7eae8c441cfa12b667e192e5fe4db0c28c770cca839b8379fbe232c4

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          6ccef2ce3761bd5999b37e1bb96c8ab2

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          7a011976fec0b450383998df0216aa14f2cab876

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          86617d23f6ca281116c195432fdea007efd9b9c350fc8b6be8a48efd2303d4c4

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          733c1d3917dd5566304f87750d5b771f0d7d2810b9ed5b03fa4bf1ceded1fb50294e643eccbf64a5064fbb1f4be3512a4945313ffe6ed4de588ffbfc1bba6e3e

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          6ccef2ce3761bd5999b37e1bb96c8ab2

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          7a011976fec0b450383998df0216aa14f2cab876

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          86617d23f6ca281116c195432fdea007efd9b9c350fc8b6be8a48efd2303d4c4

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          733c1d3917dd5566304f87750d5b771f0d7d2810b9ed5b03fa4bf1ceded1fb50294e643eccbf64a5064fbb1f4be3512a4945313ffe6ed4de588ffbfc1bba6e3e

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          0c523282c86c4d525d46a68a8983120a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          3427aea863d5b04b9927796599cbd9e74501dc3e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          7f33b4f2b2f6d0c409fa01f9a736650003093362fe7de3345e9328e37d6d8c8f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          f2da8f74b983e7a37a95daf34e0c6c56075cae0b2afeeabb672b3f55cc40b34fcd4b4976b8bddd306c2f0d576aa178aef2ac805aeacff0ca3dd3c323cc48f546

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          0c523282c86c4d525d46a68a8983120a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          3427aea863d5b04b9927796599cbd9e74501dc3e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          7f33b4f2b2f6d0c409fa01f9a736650003093362fe7de3345e9328e37d6d8c8f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          f2da8f74b983e7a37a95daf34e0c6c56075cae0b2afeeabb672b3f55cc40b34fcd4b4976b8bddd306c2f0d576aa178aef2ac805aeacff0ca3dd3c323cc48f546

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          0c523282c86c4d525d46a68a8983120a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          3427aea863d5b04b9927796599cbd9e74501dc3e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          7f33b4f2b2f6d0c409fa01f9a736650003093362fe7de3345e9328e37d6d8c8f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          f2da8f74b983e7a37a95daf34e0c6c56075cae0b2afeeabb672b3f55cc40b34fcd4b4976b8bddd306c2f0d576aa178aef2ac805aeacff0ca3dd3c323cc48f546

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          0c523282c86c4d525d46a68a8983120a

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          3427aea863d5b04b9927796599cbd9e74501dc3e

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          7f33b4f2b2f6d0c409fa01f9a736650003093362fe7de3345e9328e37d6d8c8f

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          f2da8f74b983e7a37a95daf34e0c6c56075cae0b2afeeabb672b3f55cc40b34fcd4b4976b8bddd306c2f0d576aa178aef2ac805aeacff0ca3dd3c323cc48f546

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          1dd02b37592e6b0a7ca0cb7574cd7b06

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          22c3ef2ace70d7847f9f543dd5f8aa88d7370c0c

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          4073eb970e3b1ebf523b6b29e6c5e9768f1d3c977baa513955d471ed1f86df12

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          6d4f4de6b45209ac58ad6ac5c14222cf8a5f32dadc8b508a3271aeb11750f9906d0fb7be2204c4c206198d03f779e1eac777fe241f73cf85b8f4abb8a23b7b2c

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          1dd02b37592e6b0a7ca0cb7574cd7b06

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          22c3ef2ace70d7847f9f543dd5f8aa88d7370c0c

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          4073eb970e3b1ebf523b6b29e6c5e9768f1d3c977baa513955d471ed1f86df12

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          6d4f4de6b45209ac58ad6ac5c14222cf8a5f32dadc8b508a3271aeb11750f9906d0fb7be2204c4c206198d03f779e1eac777fe241f73cf85b8f4abb8a23b7b2c

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          4377777cb2c90587c9ffa69d514ea343

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          6d5522d9ccf1674f735c9144ead2721c64773840

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          13799edb821b01212e0278c4baabe3b72577f7875b757e9a06df72070c68f909

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          ec4c1f2eb00314f6477fc3898ec9370c18198f928a89df540b6eea06000109a0f1e289180c55bb4ef49335fab87b5207b448939d82e8adee45e0497fbf47e0f0

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          4377777cb2c90587c9ffa69d514ea343

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          6d5522d9ccf1674f735c9144ead2721c64773840

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          13799edb821b01212e0278c4baabe3b72577f7875b757e9a06df72070c68f909

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          ec4c1f2eb00314f6477fc3898ec9370c18198f928a89df540b6eea06000109a0f1e289180c55bb4ef49335fab87b5207b448939d82e8adee45e0497fbf47e0f0

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          8bba88bfc8bc2d5c9f4b9ee2e37bee85

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          bca8daaf86b7173b806d4448cc150500f784af19

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          bbf05b7f86fabf78aac234b44df2216508f89ef95fa9ee259792d6de06d7f007

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          ebb9171e3057a9fc09be697038f8f31547c7a8b2adaf8f8d55581f445a54416afe1b82ab84cdf3b0be75de46f29e316b2ab6b4c384bf7b15900f33c1006c1869

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          8bba88bfc8bc2d5c9f4b9ee2e37bee85

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          bca8daaf86b7173b806d4448cc150500f784af19

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          bbf05b7f86fabf78aac234b44df2216508f89ef95fa9ee259792d6de06d7f007

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          ebb9171e3057a9fc09be697038f8f31547c7a8b2adaf8f8d55581f445a54416afe1b82ab84cdf3b0be75de46f29e316b2ab6b4c384bf7b15900f33c1006c1869

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          152e92422446082d1e22cc75f73c6476

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          74bb185d58feb68cb9134335de1d812ea9e06d0b

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          d887307ff6f9c971bc913e1bff2b5bf837147bf0e9c934e709fb5076786e98a1

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          4b1ca606f680210e0bf1ef725aeeda8cc15e57af117b84a0ec17874d81896035384bff5bb895f1612387285ef4ff47e6eba74445edda3669f0232fda87101164

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          152e92422446082d1e22cc75f73c6476

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          74bb185d58feb68cb9134335de1d812ea9e06d0b

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          d887307ff6f9c971bc913e1bff2b5bf837147bf0e9c934e709fb5076786e98a1

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          4b1ca606f680210e0bf1ef725aeeda8cc15e57af117b84a0ec17874d81896035384bff5bb895f1612387285ef4ff47e6eba74445edda3669f0232fda87101164

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          cb18b0a76cf608ac4213d1c651ddbba5

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          b653ec679eb2e9a4004d34f3bb16d6ef1eaac683

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          d022ae516af1c2609b3df6dd751ecadabb1495eaeecdb790060185ad80f2dc43

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          cc23c9aefa3e3e3d971e5b2b4182e0b983e10df365868d33b4e6854e814b92db7be18cd32ad710df11561b9b000cb233081e14e59a3cf65618928d65f39bbd14

                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                          cb18b0a76cf608ac4213d1c651ddbba5

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                          b653ec679eb2e9a4004d34f3bb16d6ef1eaac683

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                          d022ae516af1c2609b3df6dd751ecadabb1495eaeecdb790060185ad80f2dc43

                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                          cc23c9aefa3e3e3d971e5b2b4182e0b983e10df365868d33b4e6854e814b92db7be18cd32ad710df11561b9b000cb233081e14e59a3cf65618928d65f39bbd14