Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2022, 17:33

General

  • Target

    181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe

  • Size

    72KB

  • MD5

    0cd4a736b9016f93262eb1be23b6f27b

  • SHA1

    b69800d2d0978855a370404dbad320c2f923fb6c

  • SHA256

    181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e

  • SHA512

    cf4b5e90866415b88a50100629d63c1b15c7bb637f110dba2977f69e288e75d3880831642c0b14ae2a805a28795f04c24f15efeac983e9d86b9364e3d9c5ef97

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf21:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr5

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe
    "C:\Users\Admin\AppData\Local\Temp\181ace7d619f0f60fc771decba036c1b1542b852fd0b06de769564aa90ec034e.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin\AppData\Local\Temp\3249027206\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3249027206\backup.exe C:\Users\Admin\AppData\Local\Temp\3249027206\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5112
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1356
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1460
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2356
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1140
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4152
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3540
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3808
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4496
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3156
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1044
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:4956
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:960
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2936
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1832
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2580
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4412
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4680
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4512
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5084
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4408
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1956
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2036
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • System policy modification
                  PID:788
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:844
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                    PID:4488
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                    8⤵
                    • Drops file in Program Files directory
                    PID:4976
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:1736
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:4760
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      PID:740
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:2084
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:3096
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                      9⤵
                      • Disables RegEdit via registry modification
                      PID:4384
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                      9⤵
                        PID:2836
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                        9⤵
                          PID:2936
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                          9⤵
                            PID:3700
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                            9⤵
                            • Disables RegEdit via registry modification
                            PID:4864
                        • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                          8⤵
                          • Disables RegEdit via registry modification
                          PID:2268
                        • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:2356
                        • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                          8⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:2092
                        • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                          8⤵
                            PID:3772
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                          7⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:3028
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                            8⤵
                              PID:3368
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                              8⤵
                                PID:4688
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                8⤵
                                  PID:2184
                                • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe
                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                  8⤵
                                    PID:1120
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:4040
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                    8⤵
                                      PID:2268
                                  • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                    7⤵
                                    • System policy modification
                                    PID:208
                                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:4928
                                  • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                    7⤵
                                      PID:3260
                                    • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                      7⤵
                                        PID:4996
                                      • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:4680
                                        • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          PID:1492
                                      • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • System policy modification
                                        PID:3772
                                      • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                        7⤵
                                        • Disables RegEdit via registry modification
                                        PID:4548
                                        • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          PID:4796
                                      • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                        7⤵
                                          PID:1536
                                      • C:\Program Files\Common Files\Services\backup.exe
                                        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                        6⤵
                                        • Executes dropped EXE
                                        PID:240
                                      • C:\Program Files\Common Files\System\backup.exe
                                        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                        6⤵
                                        • Drops file in Program Files directory
                                        PID:4924
                                        • C:\Program Files\Common Files\System\ado\data.exe
                                          "C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\
                                          7⤵
                                          • Drops file in Program Files directory
                                          PID:3128
                                          • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                            "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                            8⤵
                                              PID:1684
                                            • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                              "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                              8⤵
                                              • System policy modification
                                              PID:2392
                                            • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                              "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                              8⤵
                                              • System policy modification
                                              PID:1492
                                            • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                              "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                              8⤵
                                              • Disables RegEdit via registry modification
                                              • System policy modification
                                              PID:1256
                                            • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                              "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                              8⤵
                                                PID:3776
                                              • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:4104
                                            • C:\Program Files\Common Files\System\de-DE\backup.exe
                                              "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                              7⤵
                                                PID:3664
                                              • C:\Program Files\Common Files\System\en-US\backup.exe
                                                "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                7⤵
                                                  PID:4396
                                                • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                  "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                  7⤵
                                                    PID:1876
                                                  • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                    "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                    7⤵
                                                      PID:1408
                                                    • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                      "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                      7⤵
                                                        PID:2148
                                                      • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                        "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                        7⤵
                                                        • Disables RegEdit via registry modification
                                                        PID:736
                                                      • C:\Program Files\Common Files\System\msadc\backup.exe
                                                        "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                        7⤵
                                                        • Drops file in Program Files directory
                                                        PID:1960
                                                        • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                          "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System policy modification
                                                          PID:2712
                                                  • C:\Program Files\Google\backup.exe
                                                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                    5⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2888
                                                    • C:\Program Files\Google\Chrome\backup.exe
                                                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1432
                                                      • C:\Program Files\Google\Chrome\Application\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                        7⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4804
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of SetWindowsHookEx
                                                          • System policy modification
                                                          PID:1924
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                            9⤵
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:4308
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                            9⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1896
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                            9⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5060
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                            9⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1612
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                            9⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4160
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                            9⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1776
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                            9⤵
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4000
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                            9⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1500
                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                              10⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2636
                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                11⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1236
                                                        • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3548
                                                  • C:\Program Files\Internet Explorer\backup.exe
                                                    "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                    5⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Drops file in Program Files directory
                                                    • System policy modification
                                                    PID:2356
                                                    • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                      "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                      6⤵
                                                        PID:4828
                                                      • C:\Program Files\Internet Explorer\en-US\update.exe
                                                        "C:\Program Files\Internet Explorer\en-US\update.exe" C:\Program Files\Internet Explorer\en-US\
                                                        6⤵
                                                          PID:2060
                                                        • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                          "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                          6⤵
                                                          • System policy modification
                                                          PID:1692
                                                        • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                          "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                          6⤵
                                                            PID:4412
                                                          • C:\Program Files\Internet Explorer\images\backup.exe
                                                            "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                            6⤵
                                                            • Disables RegEdit via registry modification
                                                            PID:3152
                                                          • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                            "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                            6⤵
                                                            • System policy modification
                                                            PID:4180
                                                          • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                            "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                            6⤵
                                                              PID:2276
                                                            • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                              "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                              6⤵
                                                              • System policy modification
                                                              PID:8
                                                          • C:\Program Files\Java\backup.exe
                                                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                            5⤵
                                                            • Disables RegEdit via registry modification
                                                            • Drops file in Program Files directory
                                                            PID:3180
                                                            • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                              "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                              6⤵
                                                              • Drops file in Program Files directory
                                                              PID:756
                                                              • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                7⤵
                                                                  PID:748
                                                                • C:\Program Files\Java\jdk1.8.0_66\db\System Restore.exe
                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                  7⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:2324
                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                    8⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    PID:2372
                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\lib\update.exe
                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\lib\update.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                    8⤵
                                                                      PID:2520
                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                    7⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Drops file in Program Files directory
                                                                    PID:4152
                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                      8⤵
                                                                      • System policy modification
                                                                      PID:4448
                                                                      • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                        "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                        9⤵
                                                                        • System policy modification
                                                                        PID:1524
                                                                • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                  "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                  6⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:2020
                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                    7⤵
                                                                      PID:3196
                                                                • C:\Program Files\Microsoft Office\backup.exe
                                                                  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                  5⤵
                                                                  • Drops file in Program Files directory
                                                                  PID:1816
                                                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                    6⤵
                                                                      PID:3876
                                                                    • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                      "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                      6⤵
                                                                      • Disables RegEdit via registry modification
                                                                      PID:1624
                                                                    • C:\Program Files\Microsoft Office\root\backup.exe
                                                                      "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                      6⤵
                                                                        PID:1564
                                                                  • C:\Program Files (x86)\backup.exe
                                                                    "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                    4⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Executes dropped EXE
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4100
                                                                    • C:\Program Files (x86)\Adobe\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3112
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                        6⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:4476
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                          7⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:3820
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                          7⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:3940
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                            8⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:2248
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:2760
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\data.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                            8⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4416
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1640
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2660
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                            8⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4824
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                            8⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:4780
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                              9⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5020
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                            8⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:632
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                              9⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2424
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                            8⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4864
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                            8⤵
                                                                              PID:4748
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                9⤵
                                                                                • Disables RegEdit via registry modification
                                                                                PID:2864
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              PID:444
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                9⤵
                                                                                  PID:2836
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                8⤵
                                                                                • Drops file in Program Files directory
                                                                                • System policy modification
                                                                                PID:1640
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                  9⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Drops file in Program Files directory
                                                                                  PID:932
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                    10⤵
                                                                                      PID:3996
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\update.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                    9⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • System policy modification
                                                                                    PID:1432
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                      10⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:3608
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                        11⤵
                                                                                          PID:4504
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                      9⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:4688
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                        10⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        PID:4488
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                      9⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      • System policy modification
                                                                                      PID:1120
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                    8⤵
                                                                                    • System policy modification
                                                                                    PID:4168
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                      9⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:3456
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                    8⤵
                                                                                    • System policy modification
                                                                                    PID:3676
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                    8⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:2568
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                    8⤵
                                                                                      PID:1176
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Program Files directory
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    • System policy modification
                                                                                    PID:2004
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\update.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                      8⤵
                                                                                        PID:3524
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                          9⤵
                                                                                            PID:4320
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                          8⤵
                                                                                            PID:5100
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                            8⤵
                                                                                              PID:4008
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                            7⤵
                                                                                              PID:4448
                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                8⤵
                                                                                                  PID:4088
                                                                                          • C:\Program Files (x86)\Common Files\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                            5⤵
                                                                                              PID:3428
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\data.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\data.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                6⤵
                                                                                                • Drops file in Program Files directory
                                                                                                • System policy modification
                                                                                                PID:3812
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                  7⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:4312
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                  7⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:1732
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                  7⤵
                                                                                                  • System policy modification
                                                                                                  PID:4780
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                    8⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    PID:3676
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                  7⤵
                                                                                                    PID:3692
                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                      8⤵
                                                                                                      • System policy modification
                                                                                                      PID:2296
                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\System Restore.exe
                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                        9⤵
                                                                                                        • System policy modification
                                                                                                        PID:3524
                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                          10⤵
                                                                                                          • System policy modification
                                                                                                          PID:2504
                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                          10⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          PID:3404
                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                            11⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            PID:1732
                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                            11⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            PID:4248
                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\update.exe
                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                              12⤵
                                                                                                                PID:4036
                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\System Restore.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
                                                                                                                  13⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  PID:640
                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
                                                                                                                    14⤵
                                                                                                                      PID:4396
                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
                                                                                                                      14⤵
                                                                                                                        PID:4412
                                                                                                      • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                        "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                        6⤵
                                                                                                          PID:480
                                                                                                          • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                            "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                            7⤵
                                                                                                              PID:868
                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                            6⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • System policy modification
                                                                                                            PID:4308
                                                                                                        • C:\Program Files (x86)\Google\backup.exe
                                                                                                          "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                          5⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • Drops file in Program Files directory
                                                                                                          • System policy modification
                                                                                                          PID:364
                                                                                                          • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                            "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                            6⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            PID:1528
                                                                                                          • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                            "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                            6⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            PID:4816
                                                                                                          • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                            "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                            6⤵
                                                                                                              PID:2024
                                                                                                            • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                              "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                              6⤵
                                                                                                                PID:4000
                                                                                                          • C:\Users\backup.exe
                                                                                                            C:\Users\backup.exe C:\Users\
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:3740
                                                                                                            • C:\Users\Admin\update.exe
                                                                                                              C:\Users\Admin\update.exe C:\Users\Admin\
                                                                                                              5⤵
                                                                                                                PID:1300
                                                                                                                • C:\Users\Admin\3D Objects\update.exe
                                                                                                                  "C:\Users\Admin\3D Objects\update.exe" C:\Users\Admin\3D Objects\
                                                                                                                  6⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  PID:2884
                                                                                                                • C:\Users\Admin\Contacts\backup.exe
                                                                                                                  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                  6⤵
                                                                                                                    PID:2504
                                                                                                                  • C:\Users\Admin\Desktop\backup.exe
                                                                                                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                    6⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:1620
                                                                                                                  • C:\Users\Admin\Documents\backup.exe
                                                                                                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                    6⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:1552
                                                                                                                  • C:\Users\Admin\Downloads\backup.exe
                                                                                                                    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                    6⤵
                                                                                                                      PID:2588
                                                                                                                    • C:\Users\Admin\Favorites\backup.exe
                                                                                                                      C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                      6⤵
                                                                                                                        PID:4364
                                                                                                                      • C:\Users\Admin\Links\update.exe
                                                                                                                        C:\Users\Admin\Links\update.exe C:\Users\Admin\Links\
                                                                                                                        6⤵
                                                                                                                          PID:4252
                                                                                                                        • C:\Users\Admin\Music\backup.exe
                                                                                                                          C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                          6⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:1468
                                                                                                                        • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                          C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                          6⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • System policy modification
                                                                                                                          PID:5044
                                                                                                                        • C:\Users\Admin\Pictures\backup.exe
                                                                                                                          C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                          6⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          PID:4600
                                                                                                                          • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                            "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                            7⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • System policy modification
                                                                                                                            PID:3440
                                                                                                                          • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                            "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                            7⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • System policy modification
                                                                                                                            PID:1736
                                                                                                                        • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                          "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                          6⤵
                                                                                                                          • System policy modification
                                                                                                                          PID:3132
                                                                                                                        • C:\Users\Admin\Searches\backup.exe
                                                                                                                          C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                          6⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:5096
                                                                                                                        • C:\Users\Admin\Videos\backup.exe
                                                                                                                          C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                          6⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • System policy modification
                                                                                                                          PID:3188
                                                                                                                      • C:\Users\Public\backup.exe
                                                                                                                        C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                        5⤵
                                                                                                                          PID:4408
                                                                                                                          • C:\Users\Public\Documents\backup.exe
                                                                                                                            C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                            6⤵
                                                                                                                            • System policy modification
                                                                                                                            PID:3420
                                                                                                                          • C:\Users\Public\Downloads\update.exe
                                                                                                                            C:\Users\Public\Downloads\update.exe C:\Users\Public\Downloads\
                                                                                                                            6⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • System policy modification
                                                                                                                            PID:4132
                                                                                                                          • C:\Users\Public\Music\backup.exe
                                                                                                                            C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                            6⤵
                                                                                                                            • System policy modification
                                                                                                                            PID:1972
                                                                                                                      • C:\Windows\backup.exe
                                                                                                                        C:\Windows\backup.exe C:\Windows\
                                                                                                                        4⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System policy modification
                                                                                                                        PID:5088
                                                                                                                        • C:\Windows\addins\backup.exe
                                                                                                                          C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                          5⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          PID:4496
                                                                                                                        • C:\Windows\appcompat\data.exe
                                                                                                                          C:\Windows\appcompat\data.exe C:\Windows\appcompat\
                                                                                                                          5⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          PID:2732
                                                                                                                          • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                            C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                            6⤵
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:880
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:964
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:3496
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:392
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                    2⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:4668
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                    2⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    • System policy modification
                                                                                                                    PID:3376
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                    2⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:3028
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                  1⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  PID:2924
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                    2⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:3580
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                      3⤵
                                                                                                                        PID:3556
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                        3⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        PID:212
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                        3⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        PID:4260
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                      2⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      PID:4244
                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                    1⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    PID:4092

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\PerfLogs\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5910551d18e1e49d399b1bf8c7f1f87c

                                                                                                                    SHA1

                                                                                                                    0ca90fe7661d7a12603b8f02eecbf06b3982a378

                                                                                                                    SHA256

                                                                                                                    12031118801ff2d5a58bf5e055e13bbd9db5c031cc676533e9d1217176134cea

                                                                                                                    SHA512

                                                                                                                    4ed93f2af5eadb64e01c80686219392d0c1ac4773db8f06378adcb47dc7dcb65b4087eb9753ba88bc836149faba764275b2f81dc3a3ebd55f00486c645749e88

                                                                                                                  • C:\PerfLogs\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5910551d18e1e49d399b1bf8c7f1f87c

                                                                                                                    SHA1

                                                                                                                    0ca90fe7661d7a12603b8f02eecbf06b3982a378

                                                                                                                    SHA256

                                                                                                                    12031118801ff2d5a58bf5e055e13bbd9db5c031cc676533e9d1217176134cea

                                                                                                                    SHA512

                                                                                                                    4ed93f2af5eadb64e01c80686219392d0c1ac4773db8f06378adcb47dc7dcb65b4087eb9753ba88bc836149faba764275b2f81dc3a3ebd55f00486c645749e88

                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    eeb17930b0bf1d9f1bc909fed2a9d93c

                                                                                                                    SHA1

                                                                                                                    20b633ea945a566881656f73086168c12f42db4c

                                                                                                                    SHA256

                                                                                                                    1b80e20388ac6b7cba8bd5501606ead6c3cb8c5726c860a57732da88be889d4e

                                                                                                                    SHA512

                                                                                                                    9225cfad268bac9bb85bb7348b8a42d426e108925ffc2a3c832f4a048a3710fc710617766e187d6ed1ea7a3032e3fda20cb5d5f654b4ec76124ec6b65d0210d2

                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    eeb17930b0bf1d9f1bc909fed2a9d93c

                                                                                                                    SHA1

                                                                                                                    20b633ea945a566881656f73086168c12f42db4c

                                                                                                                    SHA256

                                                                                                                    1b80e20388ac6b7cba8bd5501606ead6c3cb8c5726c860a57732da88be889d4e

                                                                                                                    SHA512

                                                                                                                    9225cfad268bac9bb85bb7348b8a42d426e108925ffc2a3c832f4a048a3710fc710617766e187d6ed1ea7a3032e3fda20cb5d5f654b4ec76124ec6b65d0210d2

                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    84c00e46f7e63f038a7a8a0f74648ccc

                                                                                                                    SHA1

                                                                                                                    04c8285e0a4aeeaf4d84ca34e90a820551cbb587

                                                                                                                    SHA256

                                                                                                                    cfa23b5ef675eb176c60a107f36d69e7b6372b60ca5b6e60c864ee131c375f6c

                                                                                                                    SHA512

                                                                                                                    d94fe9da08346d3927b64d2eff642db0810e59fc686dce971b8dfba86fd626a84fd8e3ef3cd217a058ad46ec2c4fe04c38a18d89c268f5ee0165190838c0424b

                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    84c00e46f7e63f038a7a8a0f74648ccc

                                                                                                                    SHA1

                                                                                                                    04c8285e0a4aeeaf4d84ca34e90a820551cbb587

                                                                                                                    SHA256

                                                                                                                    cfa23b5ef675eb176c60a107f36d69e7b6372b60ca5b6e60c864ee131c375f6c

                                                                                                                    SHA512

                                                                                                                    d94fe9da08346d3927b64d2eff642db0810e59fc686dce971b8dfba86fd626a84fd8e3ef3cd217a058ad46ec2c4fe04c38a18d89c268f5ee0165190838c0424b

                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    23214be108f447104f5b0995dfe1ee2c

                                                                                                                    SHA1

                                                                                                                    5d7456b2507ee6d35817d63dfeeb7af055d14b2d

                                                                                                                    SHA256

                                                                                                                    945e32d8ba1e17c042db13fe5a267bb873972eac393bce1fceae8ef99ee355b6

                                                                                                                    SHA512

                                                                                                                    d6e5e89e39f236d07aa80f1ebbd58cbaf527e34b277b8e6469a191a73eec8e036d7cc0b3b29a0a9196fd7e324f64a8c9c89fa924e8a20557e2ed28702a56f741

                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    23214be108f447104f5b0995dfe1ee2c

                                                                                                                    SHA1

                                                                                                                    5d7456b2507ee6d35817d63dfeeb7af055d14b2d

                                                                                                                    SHA256

                                                                                                                    945e32d8ba1e17c042db13fe5a267bb873972eac393bce1fceae8ef99ee355b6

                                                                                                                    SHA512

                                                                                                                    d6e5e89e39f236d07aa80f1ebbd58cbaf527e34b277b8e6469a191a73eec8e036d7cc0b3b29a0a9196fd7e324f64a8c9c89fa924e8a20557e2ed28702a56f741

                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    0de9b6b33bacccffdcc971ac2888704c

                                                                                                                    SHA1

                                                                                                                    2abcef28c353519ac7dd71a75f53d3af0959981c

                                                                                                                    SHA256

                                                                                                                    0db19ece0f9859379a1b70a7512b943accbd5aa4f9abc95375080b320a0d5709

                                                                                                                    SHA512

                                                                                                                    efb6748f939f1986646017809265d7a3a45a35b37259bd0279c024d5f9bced6068959125d2464c3e5839d7743cc34839637e665a54d119a7d88f7eb5fdc61743

                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    0de9b6b33bacccffdcc971ac2888704c

                                                                                                                    SHA1

                                                                                                                    2abcef28c353519ac7dd71a75f53d3af0959981c

                                                                                                                    SHA256

                                                                                                                    0db19ece0f9859379a1b70a7512b943accbd5aa4f9abc95375080b320a0d5709

                                                                                                                    SHA512

                                                                                                                    efb6748f939f1986646017809265d7a3a45a35b37259bd0279c024d5f9bced6068959125d2464c3e5839d7743cc34839637e665a54d119a7d88f7eb5fdc61743

                                                                                                                  • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    ada9dc43f2f3b1b22ce82b67bdd52e36

                                                                                                                    SHA1

                                                                                                                    61236822a36d54f14f7ae125bb3b3ff79c263767

                                                                                                                    SHA256

                                                                                                                    4965a9453fe47280bee92d835af47d8faf3976ecd2053037217683c0df0f1d3d

                                                                                                                    SHA512

                                                                                                                    3d37c4a91971cb06349bce8b9bd5684f4f8e77fd0cb9edae3f3b5f806763a616159596f0696bdf60f8047c6dc49ff5844e027b4f1330e21976466f48993868e9

                                                                                                                  • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    ada9dc43f2f3b1b22ce82b67bdd52e36

                                                                                                                    SHA1

                                                                                                                    61236822a36d54f14f7ae125bb3b3ff79c263767

                                                                                                                    SHA256

                                                                                                                    4965a9453fe47280bee92d835af47d8faf3976ecd2053037217683c0df0f1d3d

                                                                                                                    SHA512

                                                                                                                    3d37c4a91971cb06349bce8b9bd5684f4f8e77fd0cb9edae3f3b5f806763a616159596f0696bdf60f8047c6dc49ff5844e027b4f1330e21976466f48993868e9

                                                                                                                  • C:\Program Files (x86)\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    da340e0a201dc2c8a9a78d7c18b76770

                                                                                                                    SHA1

                                                                                                                    f9212f2441a7048b796f5837f36c8e3fc1e045a0

                                                                                                                    SHA256

                                                                                                                    aeea3cc0c57e54eb55fa7d6353892e6805f9fbb96af4fc62b48546d1e79431c8

                                                                                                                    SHA512

                                                                                                                    b610b327163d4edfde3f0f2f2e02bc299eddc0aaf71d728ec535309bc0898cb1558ab2f427c7657379e6ef61090e72f08c175a3ea47a6090b1a52b1e760b7d1b

                                                                                                                  • C:\Program Files (x86)\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    da340e0a201dc2c8a9a78d7c18b76770

                                                                                                                    SHA1

                                                                                                                    f9212f2441a7048b796f5837f36c8e3fc1e045a0

                                                                                                                    SHA256

                                                                                                                    aeea3cc0c57e54eb55fa7d6353892e6805f9fbb96af4fc62b48546d1e79431c8

                                                                                                                    SHA512

                                                                                                                    b610b327163d4edfde3f0f2f2e02bc299eddc0aaf71d728ec535309bc0898cb1558ab2f427c7657379e6ef61090e72f08c175a3ea47a6090b1a52b1e760b7d1b

                                                                                                                  • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    ab59a9eab5aefcef9b2ec3e95f5605db

                                                                                                                    SHA1

                                                                                                                    0052ab8a8cb2c5a945c2433ba0c5bfd9d890daaa

                                                                                                                    SHA256

                                                                                                                    bde4e7d5a5431331af314552429e5a04f2ecdbf2b0228029ac0804ca116680d5

                                                                                                                    SHA512

                                                                                                                    d58b6f8d50f5110528b4d3e03277ec0b2ad8fb25e320e1c17b53fd0db27c8c8a5ab17cc928b76b56d9046d91759cfd1c27fcb3d5a1f6e54371c54903c1efd349

                                                                                                                  • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    ab59a9eab5aefcef9b2ec3e95f5605db

                                                                                                                    SHA1

                                                                                                                    0052ab8a8cb2c5a945c2433ba0c5bfd9d890daaa

                                                                                                                    SHA256

                                                                                                                    bde4e7d5a5431331af314552429e5a04f2ecdbf2b0228029ac0804ca116680d5

                                                                                                                    SHA512

                                                                                                                    d58b6f8d50f5110528b4d3e03277ec0b2ad8fb25e320e1c17b53fd0db27c8c8a5ab17cc928b76b56d9046d91759cfd1c27fcb3d5a1f6e54371c54903c1efd349

                                                                                                                  • C:\Program Files\7-Zip\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    33273f0442308bc17001e782eedf117b

                                                                                                                    SHA1

                                                                                                                    1f22c47d000eef7e3240e75c10157bee14e5eefe

                                                                                                                    SHA256

                                                                                                                    3731dbc836132aa98a9b2eaa7dec05de48f85128c120798b0d2f063b6134593b

                                                                                                                    SHA512

                                                                                                                    e6f7c276ea46c3ca8758cac8da7b89badefef7079e0c49f04522a057cffc020b2ed03919d9d1f65ee4b5d31e87c9e2e5453e85918b520b35e8c55a48b7f64d56

                                                                                                                  • C:\Program Files\7-Zip\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    33273f0442308bc17001e782eedf117b

                                                                                                                    SHA1

                                                                                                                    1f22c47d000eef7e3240e75c10157bee14e5eefe

                                                                                                                    SHA256

                                                                                                                    3731dbc836132aa98a9b2eaa7dec05de48f85128c120798b0d2f063b6134593b

                                                                                                                    SHA512

                                                                                                                    e6f7c276ea46c3ca8758cac8da7b89badefef7079e0c49f04522a057cffc020b2ed03919d9d1f65ee4b5d31e87c9e2e5453e85918b520b35e8c55a48b7f64d56

                                                                                                                  • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    a2b26e2d4b504469e9201204d99755ae

                                                                                                                    SHA1

                                                                                                                    486fc611bf302c6acb02f14810e9ebca1e8c1e09

                                                                                                                    SHA256

                                                                                                                    bb2e56200ed2c3f97ce8f68244e5b8a3f5581e47a3ccf7683533caa8a1425e5a

                                                                                                                    SHA512

                                                                                                                    2623921297b4f641f83995eec5e02c480ed6a285d18e3e64a55efc7e93eb86688c06357598b08f5b5df6b47498c41cdbf5b812609c28c8e6bd6b7f99bb9873ae

                                                                                                                  • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    a2b26e2d4b504469e9201204d99755ae

                                                                                                                    SHA1

                                                                                                                    486fc611bf302c6acb02f14810e9ebca1e8c1e09

                                                                                                                    SHA256

                                                                                                                    bb2e56200ed2c3f97ce8f68244e5b8a3f5581e47a3ccf7683533caa8a1425e5a

                                                                                                                    SHA512

                                                                                                                    2623921297b4f641f83995eec5e02c480ed6a285d18e3e64a55efc7e93eb86688c06357598b08f5b5df6b47498c41cdbf5b812609c28c8e6bd6b7f99bb9873ae

                                                                                                                  • C:\Program Files\Common Files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    33273f0442308bc17001e782eedf117b

                                                                                                                    SHA1

                                                                                                                    1f22c47d000eef7e3240e75c10157bee14e5eefe

                                                                                                                    SHA256

                                                                                                                    3731dbc836132aa98a9b2eaa7dec05de48f85128c120798b0d2f063b6134593b

                                                                                                                    SHA512

                                                                                                                    e6f7c276ea46c3ca8758cac8da7b89badefef7079e0c49f04522a057cffc020b2ed03919d9d1f65ee4b5d31e87c9e2e5453e85918b520b35e8c55a48b7f64d56

                                                                                                                  • C:\Program Files\Common Files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    33273f0442308bc17001e782eedf117b

                                                                                                                    SHA1

                                                                                                                    1f22c47d000eef7e3240e75c10157bee14e5eefe

                                                                                                                    SHA256

                                                                                                                    3731dbc836132aa98a9b2eaa7dec05de48f85128c120798b0d2f063b6134593b

                                                                                                                    SHA512

                                                                                                                    e6f7c276ea46c3ca8758cac8da7b89badefef7079e0c49f04522a057cffc020b2ed03919d9d1f65ee4b5d31e87c9e2e5453e85918b520b35e8c55a48b7f64d56

                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    958da80da7b88157688390f545f432bd

                                                                                                                    SHA1

                                                                                                                    df06ba3b3ea2eef8c461db8e370289f2158297a7

                                                                                                                    SHA256

                                                                                                                    0e7d70a3957da0539c6e8d64cb8a7220c55f301c16d5c191924f039c8d021ea1

                                                                                                                    SHA512

                                                                                                                    c6cb432e7369542fc31e177d4850a2e2bf22cf16bd89278a5263956127a774b3e62ee2245bd7720e524885e960d7e2da0971ff8caf2523f477033c71f24423e8

                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    958da80da7b88157688390f545f432bd

                                                                                                                    SHA1

                                                                                                                    df06ba3b3ea2eef8c461db8e370289f2158297a7

                                                                                                                    SHA256

                                                                                                                    0e7d70a3957da0539c6e8d64cb8a7220c55f301c16d5c191924f039c8d021ea1

                                                                                                                    SHA512

                                                                                                                    c6cb432e7369542fc31e177d4850a2e2bf22cf16bd89278a5263956127a774b3e62ee2245bd7720e524885e960d7e2da0971ff8caf2523f477033c71f24423e8

                                                                                                                  • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    aa03a70b22ac9949d744eaa73c4be450

                                                                                                                    SHA1

                                                                                                                    2877395e354e795cba649b7fe8927aabee9666f2

                                                                                                                    SHA256

                                                                                                                    97ef926f1a58086affb7496555c6b31700e52011985b99c988b39810c4e4fbbe

                                                                                                                    SHA512

                                                                                                                    ab4bff90835ecf2d0f39d56bfeb30db032876e384a1118a6b5e642d6294c71d38a165f20bfa216000bce2e93cd3276b4d4ed95d85edd6a5b05e780270490e342

                                                                                                                  • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    aa03a70b22ac9949d744eaa73c4be450

                                                                                                                    SHA1

                                                                                                                    2877395e354e795cba649b7fe8927aabee9666f2

                                                                                                                    SHA256

                                                                                                                    97ef926f1a58086affb7496555c6b31700e52011985b99c988b39810c4e4fbbe

                                                                                                                    SHA512

                                                                                                                    ab4bff90835ecf2d0f39d56bfeb30db032876e384a1118a6b5e642d6294c71d38a165f20bfa216000bce2e93cd3276b4d4ed95d85edd6a5b05e780270490e342

                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    a825cbc1dad8a37e8387092c45ee9790

                                                                                                                    SHA1

                                                                                                                    3d60efde38556fc0110bcc609fe8a3522e71725f

                                                                                                                    SHA256

                                                                                                                    fe5176b63a6156f3a28efb416b87bd25632b564180829dd11c9ffd2bdf11531f

                                                                                                                    SHA512

                                                                                                                    f4b85d3926da34347620a5614d20d1c4cd18be49796cd2924bad1e724ffbef2231fec651f4ce4ff0edeffc204f189a6ea70c6c71061e0a2fa93d632bc85ca54d

                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    a825cbc1dad8a37e8387092c45ee9790

                                                                                                                    SHA1

                                                                                                                    3d60efde38556fc0110bcc609fe8a3522e71725f

                                                                                                                    SHA256

                                                                                                                    fe5176b63a6156f3a28efb416b87bd25632b564180829dd11c9ffd2bdf11531f

                                                                                                                    SHA512

                                                                                                                    f4b85d3926da34347620a5614d20d1c4cd18be49796cd2924bad1e724ffbef2231fec651f4ce4ff0edeffc204f189a6ea70c6c71061e0a2fa93d632bc85ca54d

                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    dcc1fedd0714353caa83514a691cd430

                                                                                                                    SHA1

                                                                                                                    caee41eb181f5c7253594a681758ed9b55c07a39

                                                                                                                    SHA256

                                                                                                                    162eaa27965f9748b035da8f82e72cc534adcf7270c917b86a2178e839dadbdc

                                                                                                                    SHA512

                                                                                                                    eb5922ea0947d87a7ccd27da298d4c1ffc4f0bc32171355c47abec8cc3eff426de676275ba447d13e6699852912420a69ded271e69724e8c966d34996f331132

                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    dcc1fedd0714353caa83514a691cd430

                                                                                                                    SHA1

                                                                                                                    caee41eb181f5c7253594a681758ed9b55c07a39

                                                                                                                    SHA256

                                                                                                                    162eaa27965f9748b035da8f82e72cc534adcf7270c917b86a2178e839dadbdc

                                                                                                                    SHA512

                                                                                                                    eb5922ea0947d87a7ccd27da298d4c1ffc4f0bc32171355c47abec8cc3eff426de676275ba447d13e6699852912420a69ded271e69724e8c966d34996f331132

                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    3e0bd14e663c68f65a40c419163d75a6

                                                                                                                    SHA1

                                                                                                                    12892e72e216cb780f2acd8a474f75890553bcd6

                                                                                                                    SHA256

                                                                                                                    8c06a997105b8d008971a6151aed5f14e6ba7690cf8d646b7a160d0a3375c6b3

                                                                                                                    SHA512

                                                                                                                    2a5d6b4b815232456597fb456cad69b02c11b0465bd7224659f60e27b2881798f8ed2ab800d61fb08befd5b21b7fb2ee50b647d86c0fe33e487fe22c859a3447

                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    3e0bd14e663c68f65a40c419163d75a6

                                                                                                                    SHA1

                                                                                                                    12892e72e216cb780f2acd8a474f75890553bcd6

                                                                                                                    SHA256

                                                                                                                    8c06a997105b8d008971a6151aed5f14e6ba7690cf8d646b7a160d0a3375c6b3

                                                                                                                    SHA512

                                                                                                                    2a5d6b4b815232456597fb456cad69b02c11b0465bd7224659f60e27b2881798f8ed2ab800d61fb08befd5b21b7fb2ee50b647d86c0fe33e487fe22c859a3447

                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    c1f60943c32aa1f6384f46818155fbb6

                                                                                                                    SHA1

                                                                                                                    7ef4de2822b8297f72f9f2147e814bb3787d190c

                                                                                                                    SHA256

                                                                                                                    9933badb1e12c106c147df944e05eb04f92a8ab285066082348e7b76d09769f1

                                                                                                                    SHA512

                                                                                                                    7d93668982c77add0c0ead055b564e55aa31981030a1b5e7842a428844f0980968253f702461d6b8ef16358408cfd48d09289b2efe4a1c0e4cb8f0f4fb87eb57

                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    c1f60943c32aa1f6384f46818155fbb6

                                                                                                                    SHA1

                                                                                                                    7ef4de2822b8297f72f9f2147e814bb3787d190c

                                                                                                                    SHA256

                                                                                                                    9933badb1e12c106c147df944e05eb04f92a8ab285066082348e7b76d09769f1

                                                                                                                    SHA512

                                                                                                                    7d93668982c77add0c0ead055b564e55aa31981030a1b5e7842a428844f0980968253f702461d6b8ef16358408cfd48d09289b2efe4a1c0e4cb8f0f4fb87eb57

                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    16758733801de9b95ada3327a2278b44

                                                                                                                    SHA1

                                                                                                                    0818b47731f31545ebbed8782ec8cfdade335928

                                                                                                                    SHA256

                                                                                                                    550f475d3eb89653b8fca4843c2977d81f30f6d96daa4adda6452863c359194f

                                                                                                                    SHA512

                                                                                                                    469f10cfaf0e2833a2735819937e9f9c85ca5e8b7772f4bf4732341a4684178d9b64076f9738b2da9e43263a1a43851fe0d4b1a539cf007cac07b12d0e00c375

                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    16758733801de9b95ada3327a2278b44

                                                                                                                    SHA1

                                                                                                                    0818b47731f31545ebbed8782ec8cfdade335928

                                                                                                                    SHA256

                                                                                                                    550f475d3eb89653b8fca4843c2977d81f30f6d96daa4adda6452863c359194f

                                                                                                                    SHA512

                                                                                                                    469f10cfaf0e2833a2735819937e9f9c85ca5e8b7772f4bf4732341a4684178d9b64076f9738b2da9e43263a1a43851fe0d4b1a539cf007cac07b12d0e00c375

                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    807518d2b5b86249d49a64ee7386e86b

                                                                                                                    SHA1

                                                                                                                    9578286cafef6558f23e3235795397ab75f9a3ee

                                                                                                                    SHA256

                                                                                                                    e7d121e8a86d17490a27d81e0a5a4ccb7612cd80154a2154f6b18300c6cb1676

                                                                                                                    SHA512

                                                                                                                    25e57437f0e1f34ac0b7f8214f8ed9a0cfdddb79556e944de789af2a6119a2637c1bde650291f9f6897d5756bb73c356c7b29d8c54c87a2a22efbb7e022e7cd7

                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    807518d2b5b86249d49a64ee7386e86b

                                                                                                                    SHA1

                                                                                                                    9578286cafef6558f23e3235795397ab75f9a3ee

                                                                                                                    SHA256

                                                                                                                    e7d121e8a86d17490a27d81e0a5a4ccb7612cd80154a2154f6b18300c6cb1676

                                                                                                                    SHA512

                                                                                                                    25e57437f0e1f34ac0b7f8214f8ed9a0cfdddb79556e944de789af2a6119a2637c1bde650291f9f6897d5756bb73c356c7b29d8c54c87a2a22efbb7e022e7cd7

                                                                                                                  • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    0dc7e02ceed86c13975d78e5fc2cb581

                                                                                                                    SHA1

                                                                                                                    4b392c9596c8c23262990befcb75ca3d9c112f78

                                                                                                                    SHA256

                                                                                                                    a0c7f96047139664be3042c6db526ef6a870326716142efb9a0988ffee8885c2

                                                                                                                    SHA512

                                                                                                                    c3e34f4493e5bcc5932129fa76a5e535123b9964a9b6fbad61d060cd479b6886d03a00babfd1cfc8652ba6f5c1d84515709ad444726e639379bd1bf7f6185318

                                                                                                                  • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    0dc7e02ceed86c13975d78e5fc2cb581

                                                                                                                    SHA1

                                                                                                                    4b392c9596c8c23262990befcb75ca3d9c112f78

                                                                                                                    SHA256

                                                                                                                    a0c7f96047139664be3042c6db526ef6a870326716142efb9a0988ffee8885c2

                                                                                                                    SHA512

                                                                                                                    c3e34f4493e5bcc5932129fa76a5e535123b9964a9b6fbad61d060cd479b6886d03a00babfd1cfc8652ba6f5c1d84515709ad444726e639379bd1bf7f6185318

                                                                                                                  • C:\Program Files\Google\Chrome\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    48706af2d21c02dda6999ae4bc45eb08

                                                                                                                    SHA1

                                                                                                                    cd75c57f6cde85435ad72af811080ed189a63642

                                                                                                                    SHA256

                                                                                                                    65c9241c12afec35f872ffb9240a321ec017ba3b154492e5922e6aeebe4dd929

                                                                                                                    SHA512

                                                                                                                    2939a7045ff8891a808e46461fc8d6443d03ce42616aa24c1f59bbcb6a3fa8372acf0b6c4e737803b9dd7adaf20ef3551e887b6b949410a785254a02e9c3c837

                                                                                                                  • C:\Program Files\Google\Chrome\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    48706af2d21c02dda6999ae4bc45eb08

                                                                                                                    SHA1

                                                                                                                    cd75c57f6cde85435ad72af811080ed189a63642

                                                                                                                    SHA256

                                                                                                                    65c9241c12afec35f872ffb9240a321ec017ba3b154492e5922e6aeebe4dd929

                                                                                                                    SHA512

                                                                                                                    2939a7045ff8891a808e46461fc8d6443d03ce42616aa24c1f59bbcb6a3fa8372acf0b6c4e737803b9dd7adaf20ef3551e887b6b949410a785254a02e9c3c837

                                                                                                                  • C:\Program Files\Google\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    2a65992cebfb6e356f6ef4d8aaf91b38

                                                                                                                    SHA1

                                                                                                                    20c7c3c6bbd30a965a0b9f7bfc1c1f84dde5c6da

                                                                                                                    SHA256

                                                                                                                    132a0ac98ced9d3dfde1a50bc842e18cff7927ed1f6b97f45b4c13928bf0c108

                                                                                                                    SHA512

                                                                                                                    4b4f887e7a634db7c1ca58784494a9742c2e915bc653958db2e3fa78b91363ddd6e163945a90ef21c7df0742fa82d2b49d39d5cffcfef09c470f1795d1a72e04

                                                                                                                  • C:\Program Files\Google\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    2a65992cebfb6e356f6ef4d8aaf91b38

                                                                                                                    SHA1

                                                                                                                    20c7c3c6bbd30a965a0b9f7bfc1c1f84dde5c6da

                                                                                                                    SHA256

                                                                                                                    132a0ac98ced9d3dfde1a50bc842e18cff7927ed1f6b97f45b4c13928bf0c108

                                                                                                                    SHA512

                                                                                                                    4b4f887e7a634db7c1ca58784494a9742c2e915bc653958db2e3fa78b91363ddd6e163945a90ef21c7df0742fa82d2b49d39d5cffcfef09c470f1795d1a72e04

                                                                                                                  • C:\Program Files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    12f9a698da9232a38a0e8b5d3818a821

                                                                                                                    SHA1

                                                                                                                    f7d3a75938b0606db4c64ee71e09599f142d6c88

                                                                                                                    SHA256

                                                                                                                    9c2260bf744b8a2425039b5095579c3c631d571a51bca730113d5bbe461dfd3a

                                                                                                                    SHA512

                                                                                                                    3114817b9887d4f7bbc23e1d449d07863fea314812fdc6eb77044b16a3fb3c97ebfa9e01daed2230736600db6ae2da78c6c73929b806a83dbba0317e750acf44

                                                                                                                  • C:\Program Files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    12f9a698da9232a38a0e8b5d3818a821

                                                                                                                    SHA1

                                                                                                                    f7d3a75938b0606db4c64ee71e09599f142d6c88

                                                                                                                    SHA256

                                                                                                                    9c2260bf744b8a2425039b5095579c3c631d571a51bca730113d5bbe461dfd3a

                                                                                                                    SHA512

                                                                                                                    3114817b9887d4f7bbc23e1d449d07863fea314812fdc6eb77044b16a3fb3c97ebfa9e01daed2230736600db6ae2da78c6c73929b806a83dbba0317e750acf44

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3249027206\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    8187fbc2cdd0c5619d6b76cfa5e8ecb5

                                                                                                                    SHA1

                                                                                                                    446fad6967345029b8db5b6f6020306badb6cf9a

                                                                                                                    SHA256

                                                                                                                    89d11643b1a8d1e4d061519e90098470f991f81a276e9138b587a915d573e259

                                                                                                                    SHA512

                                                                                                                    a61758b77f7d56b6f85aa21a6d28f38312c438b4d252d7bd1de2d531d515b5894a8512d48c784dae1ce9a360f30ecde443fd700213aedd11100d0430a90c235e

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3249027206\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    8187fbc2cdd0c5619d6b76cfa5e8ecb5

                                                                                                                    SHA1

                                                                                                                    446fad6967345029b8db5b6f6020306badb6cf9a

                                                                                                                    SHA256

                                                                                                                    89d11643b1a8d1e4d061519e90098470f991f81a276e9138b587a915d573e259

                                                                                                                    SHA512

                                                                                                                    a61758b77f7d56b6f85aa21a6d28f38312c438b4d252d7bd1de2d531d515b5894a8512d48c784dae1ce9a360f30ecde443fd700213aedd11100d0430a90c235e

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    312bf9c5e3c9448f3b568281450ff450

                                                                                                                    SHA1

                                                                                                                    6f7b27cbf9d79737928ed155b746613c7f67a910

                                                                                                                    SHA256

                                                                                                                    197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c

                                                                                                                    SHA512

                                                                                                                    d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    312bf9c5e3c9448f3b568281450ff450

                                                                                                                    SHA1

                                                                                                                    6f7b27cbf9d79737928ed155b746613c7f67a910

                                                                                                                    SHA256

                                                                                                                    197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c

                                                                                                                    SHA512

                                                                                                                    d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    312bf9c5e3c9448f3b568281450ff450

                                                                                                                    SHA1

                                                                                                                    6f7b27cbf9d79737928ed155b746613c7f67a910

                                                                                                                    SHA256

                                                                                                                    197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c

                                                                                                                    SHA512

                                                                                                                    d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    312bf9c5e3c9448f3b568281450ff450

                                                                                                                    SHA1

                                                                                                                    6f7b27cbf9d79737928ed155b746613c7f67a910

                                                                                                                    SHA256

                                                                                                                    197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c

                                                                                                                    SHA512

                                                                                                                    d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    cac5fbcf248887aae503b7cf5624764f

                                                                                                                    SHA1

                                                                                                                    bf4f198ec8dc0aee7afdfe014989a6c86fe1b614

                                                                                                                    SHA256

                                                                                                                    57cb99b0046e39bae1aef59c2d13d5d498a3e9292f98bab716a8a1158d906ba3

                                                                                                                    SHA512

                                                                                                                    1954776848ebf6f2840027da6bde504320812196e19203897ffdcf56f8d533556c4d7c7975ac3ac1ea283d77736f15b5d6134bd26cbeb97f342edccece11a83a

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    cac5fbcf248887aae503b7cf5624764f

                                                                                                                    SHA1

                                                                                                                    bf4f198ec8dc0aee7afdfe014989a6c86fe1b614

                                                                                                                    SHA256

                                                                                                                    57cb99b0046e39bae1aef59c2d13d5d498a3e9292f98bab716a8a1158d906ba3

                                                                                                                    SHA512

                                                                                                                    1954776848ebf6f2840027da6bde504320812196e19203897ffdcf56f8d533556c4d7c7975ac3ac1ea283d77736f15b5d6134bd26cbeb97f342edccece11a83a

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    312bf9c5e3c9448f3b568281450ff450

                                                                                                                    SHA1

                                                                                                                    6f7b27cbf9d79737928ed155b746613c7f67a910

                                                                                                                    SHA256

                                                                                                                    197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c

                                                                                                                    SHA512

                                                                                                                    d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    312bf9c5e3c9448f3b568281450ff450

                                                                                                                    SHA1

                                                                                                                    6f7b27cbf9d79737928ed155b746613c7f67a910

                                                                                                                    SHA256

                                                                                                                    197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c

                                                                                                                    SHA512

                                                                                                                    d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    312bf9c5e3c9448f3b568281450ff450

                                                                                                                    SHA1

                                                                                                                    6f7b27cbf9d79737928ed155b746613c7f67a910

                                                                                                                    SHA256

                                                                                                                    197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c

                                                                                                                    SHA512

                                                                                                                    d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    312bf9c5e3c9448f3b568281450ff450

                                                                                                                    SHA1

                                                                                                                    6f7b27cbf9d79737928ed155b746613c7f67a910

                                                                                                                    SHA256

                                                                                                                    197712263748d9c3a75d2dcb305d527c82221a90f64ae943ca654d4b2101ca2c

                                                                                                                    SHA512

                                                                                                                    d366c622cc8765720d9bafc4db8d611d3eda233d447bfbab4613592c946b5d2e075876aedcd7f3d5354c317d44dc9c2cf1ca8281b185f971599c0ab8697463cb

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    cac5fbcf248887aae503b7cf5624764f

                                                                                                                    SHA1

                                                                                                                    bf4f198ec8dc0aee7afdfe014989a6c86fe1b614

                                                                                                                    SHA256

                                                                                                                    57cb99b0046e39bae1aef59c2d13d5d498a3e9292f98bab716a8a1158d906ba3

                                                                                                                    SHA512

                                                                                                                    1954776848ebf6f2840027da6bde504320812196e19203897ffdcf56f8d533556c4d7c7975ac3ac1ea283d77736f15b5d6134bd26cbeb97f342edccece11a83a

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    cac5fbcf248887aae503b7cf5624764f

                                                                                                                    SHA1

                                                                                                                    bf4f198ec8dc0aee7afdfe014989a6c86fe1b614

                                                                                                                    SHA256

                                                                                                                    57cb99b0046e39bae1aef59c2d13d5d498a3e9292f98bab716a8a1158d906ba3

                                                                                                                    SHA512

                                                                                                                    1954776848ebf6f2840027da6bde504320812196e19203897ffdcf56f8d533556c4d7c7975ac3ac1ea283d77736f15b5d6134bd26cbeb97f342edccece11a83a

                                                                                                                  • C:\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    2e61d2d4d1eb197de011947b5bed6bb1

                                                                                                                    SHA1

                                                                                                                    044be2ea3caf028c30d7e1e4522dade15f9a6137

                                                                                                                    SHA256

                                                                                                                    b914d3a75350baaea7e9d22f35fe61d90fb691b018ac17f381f29c30b77fd8b9

                                                                                                                    SHA512

                                                                                                                    22da821ef6d37b038df294d84214fbf7935797bc2ccbd445881be44be3f2118457993af20b1915f094aeb13b5ec8dd0dd3a15306a6b859e5c17fa69c50887338

                                                                                                                  • C:\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    2e61d2d4d1eb197de011947b5bed6bb1

                                                                                                                    SHA1

                                                                                                                    044be2ea3caf028c30d7e1e4522dade15f9a6137

                                                                                                                    SHA256

                                                                                                                    b914d3a75350baaea7e9d22f35fe61d90fb691b018ac17f381f29c30b77fd8b9

                                                                                                                    SHA512

                                                                                                                    22da821ef6d37b038df294d84214fbf7935797bc2ccbd445881be44be3f2118457993af20b1915f094aeb13b5ec8dd0dd3a15306a6b859e5c17fa69c50887338

                                                                                                                  • C:\odt\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    01a42e24986fbde51985c46891efb2d8

                                                                                                                    SHA1

                                                                                                                    cfe0a7119ba0c67f23ab3c3f5aec556095f7e72b

                                                                                                                    SHA256

                                                                                                                    1be53b8f6f051267d9ce2bf1037fb104c29f3c3aed82392af093c998dd5f0d35

                                                                                                                    SHA512

                                                                                                                    63756e57410f283d021506f48569b418bd6d6de95ef95ba2a6a52f3e7edcee0aeb738446dbfbb6745bf28e82ef2bd74137b34bb579dee423a03deea2e74db8df

                                                                                                                  • C:\odt\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    01a42e24986fbde51985c46891efb2d8

                                                                                                                    SHA1

                                                                                                                    cfe0a7119ba0c67f23ab3c3f5aec556095f7e72b

                                                                                                                    SHA256

                                                                                                                    1be53b8f6f051267d9ce2bf1037fb104c29f3c3aed82392af093c998dd5f0d35

                                                                                                                    SHA512

                                                                                                                    63756e57410f283d021506f48569b418bd6d6de95ef95ba2a6a52f3e7edcee0aeb738446dbfbb6745bf28e82ef2bd74137b34bb579dee423a03deea2e74db8df