Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

87a62558f4...22.exe

windows7-x64

10

87a62558f4...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    193s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 12:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    87a62558f4ef53bfa41d4d5c813781b944846b7e0131b729f89018fec91c5022.exe

  • Size

    72KB

  • MD5

    097cf4b184553e8dcabf58666397143b

  • SHA1

    6fa2970ac5e5c9becad97979b7d739b5fd05ac55

  • SHA256

    87a62558f4ef53bfa41d4d5c813781b944846b7e0131b729f89018fec91c5022

  • SHA512

    4b4010be0041e5dc52afb181be207da3f48f117fa36d6f15042d1981f93c17c5dddda09bdc7b61a9b89088474860694f8b938de9d7de4afe34d99bcb8daf9aa1

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf28:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrw

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\87a62558f4ef53bfa41d4d5c813781b944846b7e0131b729f89018fec91c5022.exe
    "C:\Users\Admin\AppData\Local\Temp\87a62558f4ef53bfa41d4d5c813781b944846b7e0131b729f89018fec91c5022.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1428
    • C:\Users\Admin\AppData\Local\Temp\3972884688\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3972884688\backup.exe C:\Users\Admin\AppData\Local\Temp\3972884688\
      2⤵
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3060
      • C:\data.exe
        \data.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3480
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4432
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1828
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2408
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:316
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3560
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1520
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3452
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1932
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1144
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:1012
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4072
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4576
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4048
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2832
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1964
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1136
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4992
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:740
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1500
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1432
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4320
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1212
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                    PID:548
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                    8⤵
                      PID:1360
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                      8⤵
                      • Drops file in Program Files directory
                      PID:3996
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                        9⤵
                          PID:8
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                          9⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:4048
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                          9⤵
                          • System policy modification
                          PID:996
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\update.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                          9⤵
                          • Disables RegEdit via registry modification
                          PID:3952
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                          9⤵
                            PID:3472
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                            9⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:1068
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                            9⤵
                            • Disables RegEdit via registry modification
                            PID:1536
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                            9⤵
                              PID:2648
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                              9⤵
                              • Disables RegEdit via registry modification
                              PID:636
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                              9⤵
                              • Disables RegEdit via registry modification
                              PID:3660
                          • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                            8⤵
                            • System policy modification
                            PID:4104
                          • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:2508
                          • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                            8⤵
                              PID:4820
                            • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                              8⤵
                              • Disables RegEdit via registry modification
                              PID:2836
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                            7⤵
                            • Drops file in Program Files directory
                            PID:3196
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                              8⤵
                                PID:3692
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                8⤵
                                • Disables RegEdit via registry modification
                                PID:4832
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                8⤵
                                • System policy modification
                                PID:1860
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                8⤵
                                • Disables RegEdit via registry modification
                                PID:3888
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                8⤵
                                  PID:2032
                                • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                  8⤵
                                    PID:4852
                                • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                  7⤵
                                    PID:4360
                                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:540
                                  • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:4092
                                  • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                    7⤵
                                      PID:660
                                    • C:\Program Files\Common Files\microsoft shared\Stationery\System Restore.exe
                                      "C:\Program Files\Common Files\microsoft shared\Stationery\System Restore.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:4068
                                  • C:\Program Files\Common Files\Services\backup.exe
                                    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • System policy modification
                                    PID:1020
                                  • C:\Program Files\Common Files\System\backup.exe
                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                    6⤵
                                    • Disables RegEdit via registry modification
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:4568
                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                      7⤵
                                      • Drops file in Program Files directory
                                      PID:4812
                                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:2432
                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        PID:2848
                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                        8⤵
                                        • System policy modification
                                        PID:3328
                                      • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                        8⤵
                                          PID:1532
                                        • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                          "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                          8⤵
                                            PID:4932
                                          • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                            "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                            8⤵
                                              PID:2100
                                          • C:\Program Files\Common Files\System\de-DE\backup.exe
                                            "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:4980
                                          • C:\Program Files\Common Files\System\en-US\data.exe
                                            "C:\Program Files\Common Files\System\en-US\data.exe" C:\Program Files\Common Files\System\en-US\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:4788
                                          • C:\Program Files\Common Files\System\es-ES\backup.exe
                                            "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                            7⤵
                                              PID:3616
                                            • C:\Program Files\Common Files\System\fr-FR\update.exe
                                              "C:\Program Files\Common Files\System\fr-FR\update.exe" C:\Program Files\Common Files\System\fr-FR\
                                              7⤵
                                                PID:5072
                                              • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                7⤵
                                                  PID:1724
                                            • C:\Program Files\Google\backup.exe
                                              "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                              5⤵
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:4356
                                              • C:\Program Files\Google\Chrome\backup.exe
                                                "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                • System policy modification
                                                PID:4240
                                                • C:\Program Files\Google\Chrome\Application\backup.exe
                                                  "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                  7⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1092
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2508
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                      9⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:388
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                      9⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3416
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                      9⤵
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2608
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                      9⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:2252
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                      9⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3852
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                      9⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1488
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                      9⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:3608
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                      9⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2980
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                        10⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        • System policy modification
                                                        PID:2932
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                          11⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3496
                                                  • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2268
                                            • C:\Program Files\Internet Explorer\backup.exe
                                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                              5⤵
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:4764
                                              • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                6⤵
                                                  PID:2864
                                                • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                  6⤵
                                                    PID:2976
                                                  • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                    6⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:4280
                                                  • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                    6⤵
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:2136
                                                  • C:\Program Files\Internet Explorer\images\System Restore.exe
                                                    "C:\Program Files\Internet Explorer\images\System Restore.exe" C:\Program Files\Internet Explorer\images\
                                                    6⤵
                                                      PID:4060
                                                    • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                      "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                      6⤵
                                                        PID:1592
                                                      • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                        "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                        6⤵
                                                        • System policy modification
                                                        PID:5076
                                                      • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                        "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                        6⤵
                                                          PID:4592
                                                      • C:\Program Files\Java\backup.exe
                                                        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                        5⤵
                                                        • Disables RegEdit via registry modification
                                                        • Drops file in Program Files directory
                                                        PID:4944
                                                        • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                          "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                          6⤵
                                                          • Disables RegEdit via registry modification
                                                          • Drops file in Program Files directory
                                                          PID:400
                                                          • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                            "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            PID:4680
                                                          • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                            "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                            7⤵
                                                              PID:3420
                                                              • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:440
                                                              • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                8⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:5024
                                                            • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                              "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                              7⤵
                                                                PID:3968
                                                                • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                  8⤵
                                                                    PID:956
                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\System Restore.exe
                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                      9⤵
                                                                        PID:3872
                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\System Restore.exe
                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                    7⤵
                                                                    • Drops file in Program Files directory
                                                                    PID:4476
                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                      8⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:3244
                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                        9⤵
                                                                          PID:2784
                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\update.exe
                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\update.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                          9⤵
                                                                          • Disables RegEdit via registry modification
                                                                          PID:4932
                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                          9⤵
                                                                          • Disables RegEdit via registry modification
                                                                          PID:4872
                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                        8⤵
                                                                        • Drops file in Program Files directory
                                                                        PID:2140
                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe
                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\
                                                                          9⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:5032
                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe
                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\
                                                                          9⤵
                                                                          • Disables RegEdit via registry modification
                                                                          PID:3968
                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe
                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\
                                                                          9⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:1960
                                                                    • C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe
                                                                      "C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                      7⤵
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:2472
                                                                      • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe
                                                                        "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\
                                                                        8⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        PID:4256
                                                                        • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe
                                                                          "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\
                                                                          9⤵
                                                                            PID:4996
                                                                    • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                      "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      PID:2312
                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                        7⤵
                                                                        • Drops file in Program Files directory
                                                                        • System policy modification
                                                                        PID:2372
                                                                  • C:\Program Files\Microsoft Office\backup.exe
                                                                    "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                    5⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Disables RegEdit via registry modification
                                                                    • Drops file in Program Files directory
                                                                    PID:2800
                                                                    • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                      "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      PID:3404
                                                                    • C:\Program Files\Microsoft Office\PackageManifests\update.exe
                                                                      "C:\Program Files\Microsoft Office\PackageManifests\update.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                      6⤵
                                                                        PID:3624
                                                                      • C:\Program Files\Microsoft Office\root\backup.exe
                                                                        "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                        6⤵
                                                                          PID:4260
                                                                    • C:\Program Files (x86)\backup.exe
                                                                      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3812
                                                                      • C:\Program Files (x86)\Adobe\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3924
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4208
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2580
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                            7⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:4552
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3780
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                9⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2828
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4640
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                9⤵
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4600
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:2032
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:3448
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4760
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                9⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Executes dropped EXE
                                                                                PID:1368
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4520
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                9⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4880
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1844
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              PID:3992
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                9⤵
                                                                                  PID:4052
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                • System policy modification
                                                                                PID:1084
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                  9⤵
                                                                                  • System policy modification
                                                                                  PID:2656
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:1080
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                  9⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • System policy modification
                                                                                  PID:1588
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                    10⤵
                                                                                      PID:3152
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                    9⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:4356
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\System Restore.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                  8⤵
                                                                                  • Drops file in Program Files directory
                                                                                  • System policy modification
                                                                                  PID:3888
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                    9⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:4904
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                  8⤵
                                                                                    PID:3492
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                    8⤵
                                                                                      PID:4196
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                    7⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Drops file in Program Files directory
                                                                                    PID:3840
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                      8⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Drops file in Program Files directory
                                                                                      • System policy modification
                                                                                      PID:2524
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                        9⤵
                                                                                          PID:4788
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                        8⤵
                                                                                          PID:2828
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                          8⤵
                                                                                            PID:4152
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                          7⤵
                                                                                          • Drops file in Program Files directory
                                                                                          PID:4216
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                            8⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:2072
                                                                                    • C:\Program Files (x86)\Common Files\System Restore.exe
                                                                                      "C:\Program Files (x86)\Common Files\System Restore.exe" C:\Program Files (x86)\Common Files\
                                                                                      5⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:424
                                                                                      • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                        6⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Drops file in Program Files directory
                                                                                        • System policy modification
                                                                                        PID:4376
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                          7⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          PID:3492
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                          7⤵
                                                                                          • Disables RegEdit via registry modification
                                                                                          PID:756
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                            8⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • System policy modification
                                                                                            PID:4148
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                          7⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          PID:1304
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                            8⤵
                                                                                              PID:3516
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                9⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:2976
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                  10⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:8
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                  10⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:3120
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                    11⤵
                                                                                                      PID:4640
                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                      11⤵
                                                                                                        PID:3892
                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                          12⤵
                                                                                                            PID:4676
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                  7⤵
                                                                                                    PID:1380
                                                                                                • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                  6⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • System policy modification
                                                                                                  PID:4664
                                                                                                  • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                    7⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • System policy modification
                                                                                                    PID:4960
                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\update.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                  6⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:4876
                                                                                              • C:\Program Files (x86)\Google\backup.exe
                                                                                                "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                5⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Drops file in Program Files directory
                                                                                                PID:2580
                                                                                                • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                  "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                  6⤵
                                                                                                  • System policy modification
                                                                                                  PID:4240
                                                                                                • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                  "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                  6⤵
                                                                                                  • System policy modification
                                                                                                  PID:3360
                                                                                                • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                  "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                  6⤵
                                                                                                    PID:1904
                                                                                              • C:\Users\backup.exe
                                                                                                C:\Users\backup.exe C:\Users\
                                                                                                4⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2244
                                                                                                • C:\Users\Admin\backup.exe
                                                                                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                  5⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:3960
                                                                                                  • C:\Users\Admin\Contacts\backup.exe
                                                                                                    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:2292
                                                                                                  • C:\Users\Admin\3D Objects\backup.exe
                                                                                                    "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                    6⤵
                                                                                                      PID:2572
                                                                                                    • C:\Users\Admin\Desktop\backup.exe
                                                                                                      C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                      6⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:4876
                                                                                                    • C:\Users\Admin\Downloads\backup.exe
                                                                                                      C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                      6⤵
                                                                                                      • System policy modification
                                                                                                      PID:2312
                                                                                                    • C:\Users\Admin\Links\backup.exe
                                                                                                      C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                      6⤵
                                                                                                      • System policy modification
                                                                                                      PID:4320
                                                                                                    • C:\Users\Admin\Favorites\backup.exe
                                                                                                      C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                      6⤵
                                                                                                        PID:2548
                                                                                                      • C:\Users\Admin\Music\backup.exe
                                                                                                        C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                        6⤵
                                                                                                          PID:404
                                                                                                        • C:\Users\Admin\Documents\backup.exe
                                                                                                          C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                          6⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          PID:3180
                                                                                                        • C:\Users\Admin\OneDrive\backup.exe
                                                                                                          C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                          6⤵
                                                                                                            PID:1360
                                                                                                          • C:\Users\Admin\Pictures\backup.exe
                                                                                                            C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                            6⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            PID:4612
                                                                                                            • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                              "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                              7⤵
                                                                                                              • System policy modification
                                                                                                              PID:4212
                                                                                                            • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                              "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                              7⤵
                                                                                                                PID:1532
                                                                                                            • C:\Users\Admin\Saved Games\backup.exe
                                                                                                              "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                              6⤵
                                                                                                              • System policy modification
                                                                                                              PID:4588
                                                                                                            • C:\Users\Admin\Searches\backup.exe
                                                                                                              C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                              6⤵
                                                                                                                PID:228
                                                                                                              • C:\Users\Admin\Videos\backup.exe
                                                                                                                C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                6⤵
                                                                                                                  PID:1920
                                                                                                              • C:\Users\Public\backup.exe
                                                                                                                C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                5⤵
                                                                                                                • System policy modification
                                                                                                                PID:440
                                                                                                                • C:\Users\Public\Documents\backup.exe
                                                                                                                  C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                  6⤵
                                                                                                                    PID:1092
                                                                                                                  • C:\Users\Public\Downloads\System Restore.exe
                                                                                                                    "C:\Users\Public\Downloads\System Restore.exe" C:\Users\Public\Downloads\
                                                                                                                    6⤵
                                                                                                                    • System policy modification
                                                                                                                    PID:1688
                                                                                                                  • C:\Users\Public\Music\backup.exe
                                                                                                                    C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                    6⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:2272
                                                                                                              • C:\Windows\backup.exe
                                                                                                                C:\Windows\backup.exe C:\Windows\
                                                                                                                4⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                PID:1892
                                                                                                                • C:\Windows\addins\backup.exe
                                                                                                                  C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                  5⤵
                                                                                                                    PID:3348
                                                                                                                  • C:\Windows\appcompat\backup.exe
                                                                                                                    C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                    5⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System policy modification
                                                                                                                    PID:3748
                                                                                                                    • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                      C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                      6⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • Drops file in Windows directory
                                                                                                                      PID:1320
                                                                                                                    • C:\Windows\appcompat\encapsulation\System Restore.exe
                                                                                                                      "C:\Windows\appcompat\encapsulation\System Restore.exe" C:\Windows\appcompat\encapsulation\
                                                                                                                      6⤵
                                                                                                                        PID:2592
                                                                                                                      • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                        C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                        6⤵
                                                                                                                          PID:1608
                                                                                                                      • C:\Windows\apppatch\backup.exe
                                                                                                                        C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                        5⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System policy modification
                                                                                                                        PID:4668
                                                                                                                        • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                          C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                          6⤵
                                                                                                                            PID:1616
                                                                                                                          • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                            C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                            6⤵
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:2240
                                                                                                                            • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                              C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                              7⤵
                                                                                                                                PID:868
                                                                                                                            • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                              C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                              6⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • System policy modification
                                                                                                                              PID:3200
                                                                                                                            • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                              C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                              6⤵
                                                                                                                                PID:3320
                                                                                                                              • C:\Windows\apppatch\en-US\backup.exe
                                                                                                                                C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
                                                                                                                                6⤵
                                                                                                                                • System policy modification
                                                                                                                                PID:532
                                                                                                                              • C:\Windows\apppatch\es-ES\backup.exe
                                                                                                                                C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\
                                                                                                                                6⤵
                                                                                                                                  PID:4604
                                                                                                                                • C:\Windows\apppatch\fr-FR\data.exe
                                                                                                                                  C:\Windows\apppatch\fr-FR\data.exe C:\Windows\apppatch\fr-FR\
                                                                                                                                  6⤵
                                                                                                                                    PID:4656
                                                                                                                                • C:\Windows\AppReadiness\backup.exe
                                                                                                                                  C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                                  5⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • System policy modification
                                                                                                                                  PID:4868
                                                                                                                                • C:\Windows\assembly\backup.exe
                                                                                                                                  C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                  5⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System policy modification
                                                                                                                                  PID:5004
                                                                                                                                  • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                    C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                    6⤵
                                                                                                                                      PID:4088
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:4924
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                              2⤵
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:4888
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:4792
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:5060
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                              2⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              • System policy modification
                                                                                                                              PID:1088
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                              2⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:1632
                                                                                                                          • C:\Windows\appcompat\appraiser\Telemetry\data.exe
                                                                                                                            C:\Windows\appcompat\appraiser\Telemetry\data.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                            1⤵
                                                                                                                              PID:2216
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                              1⤵
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:2288
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                2⤵
                                                                                                                                  PID:228
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  PID:4928
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                    3⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:2812
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                    3⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    PID:1604
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                    3⤵
                                                                                                                                      PID:3604
                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                  1⤵
                                                                                                                                    PID:4636
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                    1⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:5032
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                    1⤵
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    • System policy modification
                                                                                                                                    PID:804
                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                      2⤵
                                                                                                                                      • System policy modification
                                                                                                                                      PID:1524
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                        3⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        PID:4052
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\System Restore.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                    1⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:3096

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\PerfLogs\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    a6efad8a1d43c17d11fb2401f875cd9c

                                                                                                                                    SHA1

                                                                                                                                    3b444a70639400a8dd2e5a639927e6b527a77704

                                                                                                                                    SHA256

                                                                                                                                    4f6f5f613efe2a55d6f75f12f1d23ddeb1123b5e2a8121d762cd8e482d16ad77

                                                                                                                                    SHA512

                                                                                                                                    ce7a7b2112c1b9feadd1e16b51e2056f9cd2db756a17c3e92777c88cb28d3ff593e13a1d6ed58821e3803d39e5b8ef4028127d05fe4aa169f87e04a85d64c0d1

                                                                                                                                    Download Submit

                                                                                                                                  • C:\PerfLogs\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    a6efad8a1d43c17d11fb2401f875cd9c

                                                                                                                                    SHA1

                                                                                                                                    3b444a70639400a8dd2e5a639927e6b527a77704

                                                                                                                                    SHA256

                                                                                                                                    4f6f5f613efe2a55d6f75f12f1d23ddeb1123b5e2a8121d762cd8e482d16ad77

                                                                                                                                    SHA512

                                                                                                                                    ce7a7b2112c1b9feadd1e16b51e2056f9cd2db756a17c3e92777c88cb28d3ff593e13a1d6ed58821e3803d39e5b8ef4028127d05fe4aa169f87e04a85d64c0d1

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    cd99e19b14498a931b9fe42c66d9d914

                                                                                                                                    SHA1

                                                                                                                                    4005ccb8ab869807069a659d632ffc27d0fd6ffd

                                                                                                                                    SHA256

                                                                                                                                    473eb5baf0e610a38dbd200c00e3962d5a76cdf0dfb2d0ff6976be9771350657

                                                                                                                                    SHA512

                                                                                                                                    a69933ece679947fdd9b55e35a7feaff71104a310d626adb825dd877aaa0c40d15d6ae4fc5edac868dddb980f1a64bce34de485ccb73fc9fd871d1eea7fbad97

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    cd99e19b14498a931b9fe42c66d9d914

                                                                                                                                    SHA1

                                                                                                                                    4005ccb8ab869807069a659d632ffc27d0fd6ffd

                                                                                                                                    SHA256

                                                                                                                                    473eb5baf0e610a38dbd200c00e3962d5a76cdf0dfb2d0ff6976be9771350657

                                                                                                                                    SHA512

                                                                                                                                    a69933ece679947fdd9b55e35a7feaff71104a310d626adb825dd877aaa0c40d15d6ae4fc5edac868dddb980f1a64bce34de485ccb73fc9fd871d1eea7fbad97

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    04628d18b32bd1910d57bd804c6b9561

                                                                                                                                    SHA1

                                                                                                                                    bb9a2a35703b4cc84a093aeab0de5966dc2944fc

                                                                                                                                    SHA256

                                                                                                                                    a4d625a6b73617942c384419004e179bb1c62130277a9313c02f78ec6cd5dcd2

                                                                                                                                    SHA512

                                                                                                                                    e695659c74f48efbaef7661d59f66f2ba22fef3354259690e0be9e1ed24842f088dbd5d58d64fc2bb67ad0a77ac8efb32a44c3880fef5f9dfa79c28b1f92cc42

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    04628d18b32bd1910d57bd804c6b9561

                                                                                                                                    SHA1

                                                                                                                                    bb9a2a35703b4cc84a093aeab0de5966dc2944fc

                                                                                                                                    SHA256

                                                                                                                                    a4d625a6b73617942c384419004e179bb1c62130277a9313c02f78ec6cd5dcd2

                                                                                                                                    SHA512

                                                                                                                                    e695659c74f48efbaef7661d59f66f2ba22fef3354259690e0be9e1ed24842f088dbd5d58d64fc2bb67ad0a77ac8efb32a44c3880fef5f9dfa79c28b1f92cc42

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    69d1f4750ec2c6c04e080e77347ecd08

                                                                                                                                    SHA1

                                                                                                                                    afde6b7164cd20556206b962420efb3321c2107f

                                                                                                                                    SHA256

                                                                                                                                    4d8210f44e9d92d73fe9c9c66c68235d3d6f0a8843a77102dbc7a95c76daa3e6

                                                                                                                                    SHA512

                                                                                                                                    c094160092c56c2cc5e1744ae5fc2a70113c24ac4a5f9b9fe4f0ffd659508385efd5e5387a0b74641b6e300f29e7a421ac882e66acfbfc5977890710f6f529ff

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    69d1f4750ec2c6c04e080e77347ecd08

                                                                                                                                    SHA1

                                                                                                                                    afde6b7164cd20556206b962420efb3321c2107f

                                                                                                                                    SHA256

                                                                                                                                    4d8210f44e9d92d73fe9c9c66c68235d3d6f0a8843a77102dbc7a95c76daa3e6

                                                                                                                                    SHA512

                                                                                                                                    c094160092c56c2cc5e1744ae5fc2a70113c24ac4a5f9b9fe4f0ffd659508385efd5e5387a0b74641b6e300f29e7a421ac882e66acfbfc5977890710f6f529ff

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    3a112331c348af74daa4b49dd46022db

                                                                                                                                    SHA1

                                                                                                                                    e93e90c02b716c7e8e0c8f3dd3de5b704c95bee4

                                                                                                                                    SHA256

                                                                                                                                    fcb04f42e8b1c018b6e768df3034bb4cb7b1330e28719e068e2ef1cfaf8a5c91

                                                                                                                                    SHA512

                                                                                                                                    7e088f947509798a812515d2710aed22018ede786bb273522e4946000eb11e560f8cbc61384696a3a44e8ef6a81aa5f5df4e74a794cf11d2acaa2e880b6af1ee

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    3a112331c348af74daa4b49dd46022db

                                                                                                                                    SHA1

                                                                                                                                    e93e90c02b716c7e8e0c8f3dd3de5b704c95bee4

                                                                                                                                    SHA256

                                                                                                                                    fcb04f42e8b1c018b6e768df3034bb4cb7b1330e28719e068e2ef1cfaf8a5c91

                                                                                                                                    SHA512

                                                                                                                                    7e088f947509798a812515d2710aed22018ede786bb273522e4946000eb11e560f8cbc61384696a3a44e8ef6a81aa5f5df4e74a794cf11d2acaa2e880b6af1ee

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    bbb9c3e7ed62d42e7825e2b20cb44fd9

                                                                                                                                    SHA1

                                                                                                                                    535632edb2529299e700114eed52878baab8b880

                                                                                                                                    SHA256

                                                                                                                                    373598cbe28d78c36c8cbf6064835d4ccd369fe70dd7257f8c7b16e10699d744

                                                                                                                                    SHA512

                                                                                                                                    522de0ff388a6e96cff3488b52b54771de9779e15a76182f27a4d305b742573f71b7a9bc6885b317cb2abd6fb258a0cb6b0aa39a215ba86b7babec82445eac12

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    bbb9c3e7ed62d42e7825e2b20cb44fd9

                                                                                                                                    SHA1

                                                                                                                                    535632edb2529299e700114eed52878baab8b880

                                                                                                                                    SHA256

                                                                                                                                    373598cbe28d78c36c8cbf6064835d4ccd369fe70dd7257f8c7b16e10699d744

                                                                                                                                    SHA512

                                                                                                                                    522de0ff388a6e96cff3488b52b54771de9779e15a76182f27a4d305b742573f71b7a9bc6885b317cb2abd6fb258a0cb6b0aa39a215ba86b7babec82445eac12

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    c4d55f677bf339d0656a90718499730b

                                                                                                                                    SHA1

                                                                                                                                    33ff778453b4813d0d75e74316519889eb81c70d

                                                                                                                                    SHA256

                                                                                                                                    6fc58681f8a24f00c38f1ab5a995717cdb1b3e602a3af0c564cdd35040be1fae

                                                                                                                                    SHA512

                                                                                                                                    e7cadd6b844261cbefb5432e4b7ccf53c1b05fcc606addc8be908186512a25671efdb0e1f3304c3445b3cead8352514ef3fb1c0e765d2a88d2c0621c8922d713

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files (x86)\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    c4d55f677bf339d0656a90718499730b

                                                                                                                                    SHA1

                                                                                                                                    33ff778453b4813d0d75e74316519889eb81c70d

                                                                                                                                    SHA256

                                                                                                                                    6fc58681f8a24f00c38f1ab5a995717cdb1b3e602a3af0c564cdd35040be1fae

                                                                                                                                    SHA512

                                                                                                                                    e7cadd6b844261cbefb5432e4b7ccf53c1b05fcc606addc8be908186512a25671efdb0e1f3304c3445b3cead8352514ef3fb1c0e765d2a88d2c0621c8922d713

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    65797118a57e1e9e087ce180055e899f

                                                                                                                                    SHA1

                                                                                                                                    cf08511592c19663a24f2d40aaa73d5f8efd8930

                                                                                                                                    SHA256

                                                                                                                                    679e7ac51ae75c5139e304eca7a60db1f923f7cb696b562696b2ac59273f5c4f

                                                                                                                                    SHA512

                                                                                                                                    a2e068ebcc1262b113f27658b589a02c04b30eca167181ff2a5f8c694e481821185065491298160b70217462f4e696a3466fd2a24da55464877c8e72c8847660

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    65797118a57e1e9e087ce180055e899f

                                                                                                                                    SHA1

                                                                                                                                    cf08511592c19663a24f2d40aaa73d5f8efd8930

                                                                                                                                    SHA256

                                                                                                                                    679e7ac51ae75c5139e304eca7a60db1f923f7cb696b562696b2ac59273f5c4f

                                                                                                                                    SHA512

                                                                                                                                    a2e068ebcc1262b113f27658b589a02c04b30eca167181ff2a5f8c694e481821185065491298160b70217462f4e696a3466fd2a24da55464877c8e72c8847660

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\7-Zip\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    ee67b8042931c0b7a6b00958bd32dec6

                                                                                                                                    SHA1

                                                                                                                                    df0746dec70e97473fc0d5c1db99ff6876c74ef4

                                                                                                                                    SHA256

                                                                                                                                    192efff47d4e5ef2057245a1b5f4f99180b131daefd698b30c4332814c9d06d4

                                                                                                                                    SHA512

                                                                                                                                    b24a5c575ad6221a3671af00591e840c2a8b2481aeed9dcc7ddbf6587bfb4720645c1309e3ec790cb2172a53656968a3f3bf522c6c59b6ab1865b9f01815d300

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\7-Zip\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    ee67b8042931c0b7a6b00958bd32dec6

                                                                                                                                    SHA1

                                                                                                                                    df0746dec70e97473fc0d5c1db99ff6876c74ef4

                                                                                                                                    SHA256

                                                                                                                                    192efff47d4e5ef2057245a1b5f4f99180b131daefd698b30c4332814c9d06d4

                                                                                                                                    SHA512

                                                                                                                                    b24a5c575ad6221a3671af00591e840c2a8b2481aeed9dcc7ddbf6587bfb4720645c1309e3ec790cb2172a53656968a3f3bf522c6c59b6ab1865b9f01815d300

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    3aafd8e1ba3960695c42cf62d5829a29

                                                                                                                                    SHA1

                                                                                                                                    d183c3240fdf8873b31cf07743be378522436995

                                                                                                                                    SHA256

                                                                                                                                    65110f378fb4631e2133ca675328d28ef4edc4a3f86fd60dc989ee0628f4cb1c

                                                                                                                                    SHA512

                                                                                                                                    541b0cd8c682688a7dd9bacd6c1d45a24da9a12a6927037e72f2114fd38b1c275f9dbaa98a0ec682d7df5e70dfabed30cb3b1000f39e29531836afe889686770

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    3aafd8e1ba3960695c42cf62d5829a29

                                                                                                                                    SHA1

                                                                                                                                    d183c3240fdf8873b31cf07743be378522436995

                                                                                                                                    SHA256

                                                                                                                                    65110f378fb4631e2133ca675328d28ef4edc4a3f86fd60dc989ee0628f4cb1c

                                                                                                                                    SHA512

                                                                                                                                    541b0cd8c682688a7dd9bacd6c1d45a24da9a12a6927037e72f2114fd38b1c275f9dbaa98a0ec682d7df5e70dfabed30cb3b1000f39e29531836afe889686770

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    ee67b8042931c0b7a6b00958bd32dec6

                                                                                                                                    SHA1

                                                                                                                                    df0746dec70e97473fc0d5c1db99ff6876c74ef4

                                                                                                                                    SHA256

                                                                                                                                    192efff47d4e5ef2057245a1b5f4f99180b131daefd698b30c4332814c9d06d4

                                                                                                                                    SHA512

                                                                                                                                    b24a5c575ad6221a3671af00591e840c2a8b2481aeed9dcc7ddbf6587bfb4720645c1309e3ec790cb2172a53656968a3f3bf522c6c59b6ab1865b9f01815d300

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    ee67b8042931c0b7a6b00958bd32dec6

                                                                                                                                    SHA1

                                                                                                                                    df0746dec70e97473fc0d5c1db99ff6876c74ef4

                                                                                                                                    SHA256

                                                                                                                                    192efff47d4e5ef2057245a1b5f4f99180b131daefd698b30c4332814c9d06d4

                                                                                                                                    SHA512

                                                                                                                                    b24a5c575ad6221a3671af00591e840c2a8b2481aeed9dcc7ddbf6587bfb4720645c1309e3ec790cb2172a53656968a3f3bf522c6c59b6ab1865b9f01815d300

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    c36cb5cb34afc5cc1352542ff24bd455

                                                                                                                                    SHA1

                                                                                                                                    3018013a1c48f4e4c2b0ede4d1e628896ce5c687

                                                                                                                                    SHA256

                                                                                                                                    425010de201bcbc908ab42e8051d9196ac72f58c5776039b7be4c1c2a6d5c74d

                                                                                                                                    SHA512

                                                                                                                                    a3fdcceababf3c8d0c2490899a835d61865aeed70944b2dd51b486a38e10bf444de4db01e3ce3cc3eae3c983fc69b6aa199bb19cd6a1a7c4ace579c692706fca

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    c36cb5cb34afc5cc1352542ff24bd455

                                                                                                                                    SHA1

                                                                                                                                    3018013a1c48f4e4c2b0ede4d1e628896ce5c687

                                                                                                                                    SHA256

                                                                                                                                    425010de201bcbc908ab42e8051d9196ac72f58c5776039b7be4c1c2a6d5c74d

                                                                                                                                    SHA512

                                                                                                                                    a3fdcceababf3c8d0c2490899a835d61865aeed70944b2dd51b486a38e10bf444de4db01e3ce3cc3eae3c983fc69b6aa199bb19cd6a1a7c4ace579c692706fca

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    e021a7bee3689eada9ce7b421415bc43

                                                                                                                                    SHA1

                                                                                                                                    14d75160733e72c0197e9d030634371fd6cc65bf

                                                                                                                                    SHA256

                                                                                                                                    bb69336ac3eca5da8f26fe718dc08b88802140dff24814b9f3bda8ba3c880d5f

                                                                                                                                    SHA512

                                                                                                                                    81a8490f6dd7986798629f71e539f11f69807598ddab374e9b2be536bf2088e02e07726e26e6fd04081e74b9f1a0ac0413cb96e217de43ebfbc5946a3f46ff6a

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    e021a7bee3689eada9ce7b421415bc43

                                                                                                                                    SHA1

                                                                                                                                    14d75160733e72c0197e9d030634371fd6cc65bf

                                                                                                                                    SHA256

                                                                                                                                    bb69336ac3eca5da8f26fe718dc08b88802140dff24814b9f3bda8ba3c880d5f

                                                                                                                                    SHA512

                                                                                                                                    81a8490f6dd7986798629f71e539f11f69807598ddab374e9b2be536bf2088e02e07726e26e6fd04081e74b9f1a0ac0413cb96e217de43ebfbc5946a3f46ff6a

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    fab8932dffb10a0af9902ecc3836234f

                                                                                                                                    SHA1

                                                                                                                                    103f9c501af8a932d4a7bb6c366e2e1c064701ff

                                                                                                                                    SHA256

                                                                                                                                    f0c9e70b2635fd32c60febce785336d6ab420aae884913e6823da326d9fb7433

                                                                                                                                    SHA512

                                                                                                                                    8b8c48117c17722dce23b709a625df2822b6581897b66bee5fdc13b679f998aecf02a286ab938bd97313fd60605a7208b5c983ea82820427bb752dba78ee0aa8

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    fab8932dffb10a0af9902ecc3836234f

                                                                                                                                    SHA1

                                                                                                                                    103f9c501af8a932d4a7bb6c366e2e1c064701ff

                                                                                                                                    SHA256

                                                                                                                                    f0c9e70b2635fd32c60febce785336d6ab420aae884913e6823da326d9fb7433

                                                                                                                                    SHA512

                                                                                                                                    8b8c48117c17722dce23b709a625df2822b6581897b66bee5fdc13b679f998aecf02a286ab938bd97313fd60605a7208b5c983ea82820427bb752dba78ee0aa8

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    a5b0f15922d5bbfa040a231877296eac

                                                                                                                                    SHA1

                                                                                                                                    98b4b6bc318ccf4cc9daf8bf2c8d6fd17818fae7

                                                                                                                                    SHA256

                                                                                                                                    06f6a4d92c100adab2b73b79491f2f36ae9baf0bca2af91db5502536ac4a9593

                                                                                                                                    SHA512

                                                                                                                                    8483a77378dc79bdc10dbc856cd054796f96e76ade69853f60469cba1a1e88a9664dcfe08ebb93d58f14069ab99ab4cccc364f58beae251f442b558a8d121517

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    a5b0f15922d5bbfa040a231877296eac

                                                                                                                                    SHA1

                                                                                                                                    98b4b6bc318ccf4cc9daf8bf2c8d6fd17818fae7

                                                                                                                                    SHA256

                                                                                                                                    06f6a4d92c100adab2b73b79491f2f36ae9baf0bca2af91db5502536ac4a9593

                                                                                                                                    SHA512

                                                                                                                                    8483a77378dc79bdc10dbc856cd054796f96e76ade69853f60469cba1a1e88a9664dcfe08ebb93d58f14069ab99ab4cccc364f58beae251f442b558a8d121517

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    abc5ff30d17a729e44ec8b42bb8992e3

                                                                                                                                    SHA1

                                                                                                                                    5e3ce3088daa081454f3a49a687cf1fd15a5626e

                                                                                                                                    SHA256

                                                                                                                                    f7d96005be7a8dc1ca148cb9c91addcd45553a40ffa8c140e4e7cbcee5ffb7b6

                                                                                                                                    SHA512

                                                                                                                                    3f6465be811fe81791cc42f4cfa4cd9c970935a308595965dbd2b0c02be2bd5c857003311df088931b90d956c6aeb42079a7da6d16d8890f027a6a61f0540810

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    abc5ff30d17a729e44ec8b42bb8992e3

                                                                                                                                    SHA1

                                                                                                                                    5e3ce3088daa081454f3a49a687cf1fd15a5626e

                                                                                                                                    SHA256

                                                                                                                                    f7d96005be7a8dc1ca148cb9c91addcd45553a40ffa8c140e4e7cbcee5ffb7b6

                                                                                                                                    SHA512

                                                                                                                                    3f6465be811fe81791cc42f4cfa4cd9c970935a308595965dbd2b0c02be2bd5c857003311df088931b90d956c6aeb42079a7da6d16d8890f027a6a61f0540810

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    abc5ff30d17a729e44ec8b42bb8992e3

                                                                                                                                    SHA1

                                                                                                                                    5e3ce3088daa081454f3a49a687cf1fd15a5626e

                                                                                                                                    SHA256

                                                                                                                                    f7d96005be7a8dc1ca148cb9c91addcd45553a40ffa8c140e4e7cbcee5ffb7b6

                                                                                                                                    SHA512

                                                                                                                                    3f6465be811fe81791cc42f4cfa4cd9c970935a308595965dbd2b0c02be2bd5c857003311df088931b90d956c6aeb42079a7da6d16d8890f027a6a61f0540810

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    abc5ff30d17a729e44ec8b42bb8992e3

                                                                                                                                    SHA1

                                                                                                                                    5e3ce3088daa081454f3a49a687cf1fd15a5626e

                                                                                                                                    SHA256

                                                                                                                                    f7d96005be7a8dc1ca148cb9c91addcd45553a40ffa8c140e4e7cbcee5ffb7b6

                                                                                                                                    SHA512

                                                                                                                                    3f6465be811fe81791cc42f4cfa4cd9c970935a308595965dbd2b0c02be2bd5c857003311df088931b90d956c6aeb42079a7da6d16d8890f027a6a61f0540810

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    72bb77da7a4051a902373009a6bd7005

                                                                                                                                    SHA1

                                                                                                                                    fdd43c0a91b0e1f98cc22b11315ac6b7090ca12a

                                                                                                                                    SHA256

                                                                                                                                    ee4ffed2be674cddc4300d03b8a2678238eba96f5e92dba84ba5f75d84b355fb

                                                                                                                                    SHA512

                                                                                                                                    0e5dd86361f5ca9b3dc9c1b2964e54336f371a181904c9e23a2b2c5c087a3b8aacbacecbd2f7d636848247e93003f4bf9b37fad746dea2813eb19106a3ef5edb

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    72bb77da7a4051a902373009a6bd7005

                                                                                                                                    SHA1

                                                                                                                                    fdd43c0a91b0e1f98cc22b11315ac6b7090ca12a

                                                                                                                                    SHA256

                                                                                                                                    ee4ffed2be674cddc4300d03b8a2678238eba96f5e92dba84ba5f75d84b355fb

                                                                                                                                    SHA512

                                                                                                                                    0e5dd86361f5ca9b3dc9c1b2964e54336f371a181904c9e23a2b2c5c087a3b8aacbacecbd2f7d636848247e93003f4bf9b37fad746dea2813eb19106a3ef5edb

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    4b5015692f89411241eb21df31528361

                                                                                                                                    SHA1

                                                                                                                                    b358f38bef7232c244fc857864068026f2bd0753

                                                                                                                                    SHA256

                                                                                                                                    335dfa1d6fcea69294794f2fb83ed15490bca0777ea4d14e6640b03514f1895b

                                                                                                                                    SHA512

                                                                                                                                    2c5ae803fad67dcee104bd65db9bdc7c71219bd93426c47a1d505cbc79585cb45e802b1aee15faafa35e50f986216513fa88bd3097137c6b3965feba7d53187e

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    4b5015692f89411241eb21df31528361

                                                                                                                                    SHA1

                                                                                                                                    b358f38bef7232c244fc857864068026f2bd0753

                                                                                                                                    SHA256

                                                                                                                                    335dfa1d6fcea69294794f2fb83ed15490bca0777ea4d14e6640b03514f1895b

                                                                                                                                    SHA512

                                                                                                                                    2c5ae803fad67dcee104bd65db9bdc7c71219bd93426c47a1d505cbc79585cb45e802b1aee15faafa35e50f986216513fa88bd3097137c6b3965feba7d53187e

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    d4c4ed0822641cb1b82cd37040e69e76

                                                                                                                                    SHA1

                                                                                                                                    f601149b0631c0993c7d585cf54e114902c109df

                                                                                                                                    SHA256

                                                                                                                                    b7e509b15f03f82ea47bdaf441491c9ec1d9f20c20a20080ecf5f2c677e8c787

                                                                                                                                    SHA512

                                                                                                                                    6e818404684a24a72f7b8d27b2c5ba63e3805df9ecab224c92cabf32f9a197dea9c06f5ab02f811b02fbdb7b7b304224e7dc43d612231ad2cbedb1be47511d5c

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    d4c4ed0822641cb1b82cd37040e69e76

                                                                                                                                    SHA1

                                                                                                                                    f601149b0631c0993c7d585cf54e114902c109df

                                                                                                                                    SHA256

                                                                                                                                    b7e509b15f03f82ea47bdaf441491c9ec1d9f20c20a20080ecf5f2c677e8c787

                                                                                                                                    SHA512

                                                                                                                                    6e818404684a24a72f7b8d27b2c5ba63e3805df9ecab224c92cabf32f9a197dea9c06f5ab02f811b02fbdb7b7b304224e7dc43d612231ad2cbedb1be47511d5c

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    821808cbb77e166fc45bcaa5708fe266

                                                                                                                                    SHA1

                                                                                                                                    5addd778f01a27935a85026e8f27aadc4cfe0001

                                                                                                                                    SHA256

                                                                                                                                    8e9da716bd9acd25a2eec45e79a8fc5490c9e54ab231eff60e384e4a51dd62ce

                                                                                                                                    SHA512

                                                                                                                                    5574d34e7f8d5acbfc4c4939f14ba4aa75f21bcd6cb920fcab1bdef4377fc90f62f01aa132e22f47f519f408c39217b12dccb3e5708068bb6a27bd559118e6ff

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\Chrome\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    821808cbb77e166fc45bcaa5708fe266

                                                                                                                                    SHA1

                                                                                                                                    5addd778f01a27935a85026e8f27aadc4cfe0001

                                                                                                                                    SHA256

                                                                                                                                    8e9da716bd9acd25a2eec45e79a8fc5490c9e54ab231eff60e384e4a51dd62ce

                                                                                                                                    SHA512

                                                                                                                                    5574d34e7f8d5acbfc4c4939f14ba4aa75f21bcd6cb920fcab1bdef4377fc90f62f01aa132e22f47f519f408c39217b12dccb3e5708068bb6a27bd559118e6ff

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    e64cdbcc5171caf9d12545a79e7fa34b

                                                                                                                                    SHA1

                                                                                                                                    9f6a77ad484f96490ba0bd9dde4b89f559da65d0

                                                                                                                                    SHA256

                                                                                                                                    42f16ca4f8fac8508947228f9ef946787908b9f69a7dc1bb7153190e49b0dc8c

                                                                                                                                    SHA512

                                                                                                                                    ceebacafa83a1f0acb510ab4933ee7f7990e214061b8f513dc8f2ed3c2eb54b52c190ea2e00f5d216874804860144bfbb7d1d273e1e36df0099d123ae906c389

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\Google\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    e64cdbcc5171caf9d12545a79e7fa34b

                                                                                                                                    SHA1

                                                                                                                                    9f6a77ad484f96490ba0bd9dde4b89f559da65d0

                                                                                                                                    SHA256

                                                                                                                                    42f16ca4f8fac8508947228f9ef946787908b9f69a7dc1bb7153190e49b0dc8c

                                                                                                                                    SHA512

                                                                                                                                    ceebacafa83a1f0acb510ab4933ee7f7990e214061b8f513dc8f2ed3c2eb54b52c190ea2e00f5d216874804860144bfbb7d1d273e1e36df0099d123ae906c389

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    a6efad8a1d43c17d11fb2401f875cd9c

                                                                                                                                    SHA1

                                                                                                                                    3b444a70639400a8dd2e5a639927e6b527a77704

                                                                                                                                    SHA256

                                                                                                                                    4f6f5f613efe2a55d6f75f12f1d23ddeb1123b5e2a8121d762cd8e482d16ad77

                                                                                                                                    SHA512

                                                                                                                                    ce7a7b2112c1b9feadd1e16b51e2056f9cd2db756a17c3e92777c88cb28d3ff593e13a1d6ed58821e3803d39e5b8ef4028127d05fe4aa169f87e04a85d64c0d1

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Program Files\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    a6efad8a1d43c17d11fb2401f875cd9c

                                                                                                                                    SHA1

                                                                                                                                    3b444a70639400a8dd2e5a639927e6b527a77704

                                                                                                                                    SHA256

                                                                                                                                    4f6f5f613efe2a55d6f75f12f1d23ddeb1123b5e2a8121d762cd8e482d16ad77

                                                                                                                                    SHA512

                                                                                                                                    ce7a7b2112c1b9feadd1e16b51e2056f9cd2db756a17c3e92777c88cb28d3ff593e13a1d6ed58821e3803d39e5b8ef4028127d05fe4aa169f87e04a85d64c0d1

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3972884688\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3972884688\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    5901ca8821046905624475f9a28b46eb

                                                                                                                                    SHA1

                                                                                                                                    af0a3809856eb2bfe1255ec86d77daee1539fbfa

                                                                                                                                    SHA256

                                                                                                                                    09aa4927f578df2a1eb536e6cd87944461d22bfbdceb507d26ce43fc5e55dc03

                                                                                                                                    SHA512

                                                                                                                                    b6b97fd373a3320175665aed1328115d5ee77b5b8a74c8c5406ec96d1d48152f4aa632ab42f0135be57e915799add125dcccaa875cdfb037bdf6ed840e590a63

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    3387e5e353c5ddd8ab4890be79e043a6

                                                                                                                                    SHA1

                                                                                                                                    31b490cf8a258d45c201c14cda22cb9d624d879a

                                                                                                                                    SHA256

                                                                                                                                    adb8c54f62cafaca878f2ae0d83ec778d6b983b44556be7085e3c2ce14653413

                                                                                                                                    SHA512

                                                                                                                                    20e2c42db1b92dbefb544df50a457910fe96cec3baa37b66b2ac850c72333e56fc27c7480733f966a673f73e34603a75942c43a17a6fb91241d05fc1fa959a99

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    3387e5e353c5ddd8ab4890be79e043a6

                                                                                                                                    SHA1

                                                                                                                                    31b490cf8a258d45c201c14cda22cb9d624d879a

                                                                                                                                    SHA256

                                                                                                                                    adb8c54f62cafaca878f2ae0d83ec778d6b983b44556be7085e3c2ce14653413

                                                                                                                                    SHA512

                                                                                                                                    20e2c42db1b92dbefb544df50a457910fe96cec3baa37b66b2ac850c72333e56fc27c7480733f966a673f73e34603a75942c43a17a6fb91241d05fc1fa959a99

                                                                                                                                    Download Submit

                                                                                                                                  • C:\data.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    631d38fcf51d1c57ca851288526f5a8a

                                                                                                                                    SHA1

                                                                                                                                    475c38955db7df55fe08f1d7618fe290c44c51eb

                                                                                                                                    SHA256

                                                                                                                                    bd93ffec46130607f44b8f1e90543f5f655197c09945ee5ed29e8f8463f63d02

                                                                                                                                    SHA512

                                                                                                                                    a9e8569971bd8179b732073e59b692f678b62bdba08a488783f0cb6430b571bb29abec6b01ba1fdabc4524ffe8bbc73e1f4cfd30f051a684dd8df71928eb2408

                                                                                                                                    Download Submit

                                                                                                                                  • C:\data.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    631d38fcf51d1c57ca851288526f5a8a

                                                                                                                                    SHA1

                                                                                                                                    475c38955db7df55fe08f1d7618fe290c44c51eb

                                                                                                                                    SHA256

                                                                                                                                    bd93ffec46130607f44b8f1e90543f5f655197c09945ee5ed29e8f8463f63d02

                                                                                                                                    SHA512

                                                                                                                                    a9e8569971bd8179b732073e59b692f678b62bdba08a488783f0cb6430b571bb29abec6b01ba1fdabc4524ffe8bbc73e1f4cfd30f051a684dd8df71928eb2408

                                                                                                                                    Download Submit

                                                                                                                                  • C:\odt\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    a6efad8a1d43c17d11fb2401f875cd9c

                                                                                                                                    SHA1

                                                                                                                                    3b444a70639400a8dd2e5a639927e6b527a77704

                                                                                                                                    SHA256

                                                                                                                                    4f6f5f613efe2a55d6f75f12f1d23ddeb1123b5e2a8121d762cd8e482d16ad77

                                                                                                                                    SHA512

                                                                                                                                    ce7a7b2112c1b9feadd1e16b51e2056f9cd2db756a17c3e92777c88cb28d3ff593e13a1d6ed58821e3803d39e5b8ef4028127d05fe4aa169f87e04a85d64c0d1

                                                                                                                                    Download Submit

                                                                                                                                  • C:\odt\backup.exe
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                    MD5

                                                                                                                                    a6efad8a1d43c17d11fb2401f875cd9c

                                                                                                                                    SHA1

                                                                                                                                    3b444a70639400a8dd2e5a639927e6b527a77704

                                                                                                                                    SHA256

                                                                                                                                    4f6f5f613efe2a55d6f75f12f1d23ddeb1123b5e2a8121d762cd8e482d16ad77

                                                                                                                                    SHA512

                                                                                                                                    ce7a7b2112c1b9feadd1e16b51e2056f9cd2db756a17c3e92777c88cb28d3ff593e13a1d6ed58821e3803d39e5b8ef4028127d05fe4aa169f87e04a85d64c0d1

                                                                                                                                    Download Submit