Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

fbb405b144...72.exe

windows7-x64

10

fbb405b144...72.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    168s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 00:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fbb405b1443b4124004fef210131152d8cd8f7a75670b89579849891722b7472.exe

  • Size

    72KB

  • MD5

    043b47646c1d40340a4c12d9b819c953

  • SHA1

    8229611948b8cf68a0a43256798f4c7d94fcd440

  • SHA256

    fbb405b1443b4124004fef210131152d8cd8f7a75670b89579849891722b7472

  • SHA512

    e00bf86b159f68d15c8ae4c16372ee92f0eab175e6cd67a1a9ed9d16c63369a288a67518d424af7a06ccef6992cba8c379db10734a99c42baeade710f9d983dc

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2A:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP0

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\fbb405b1443b4124004fef210131152d8cd8f7a75670b89579849891722b7472.exe
    "C:\Users\Admin\AppData\Local\Temp\fbb405b1443b4124004fef210131152d8cd8f7a75670b89579849891722b7472.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Users\Admin\AppData\Local\Temp\1180827999\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1180827999\backup.exe C:\Users\Admin\AppData\Local\Temp\1180827999\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2492
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4180
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2316
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2940
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1800
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4036
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4376
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2028
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1240
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2248
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:5068
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:704
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:5112
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\update.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3640
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1120
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2292
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3792
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:60
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4436
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  PID:792
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:4492
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:3804
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:5020
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:4620
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:4440
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Drops file in Program Files directory
                  PID:2964
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:1652
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                      PID:2456
                • C:\Program Files\Common Files\microsoft shared\MSInfo\data.exe
                  "C:\Program Files\Common Files\microsoft shared\MSInfo\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Drops file in Program Files directory
                  PID:4932
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:4020
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                    8⤵
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:8
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:2396
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:504
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                    8⤵
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:3904
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\update.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:5048
                • C:\Program Files\Common Files\microsoft shared\OFFICE16\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\OFFICE16\System Restore.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                  7⤵
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:4300
                  • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                    8⤵
                      PID:1700
                • C:\Program Files\Common Files\Services\backup.exe
                  "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                  6⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3824
                • C:\Program Files\Common Files\System\backup.exe
                  "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                  6⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4856
                  • C:\Program Files\Common Files\System\ado\System Restore.exe
                    "C:\Program Files\Common Files\System\ado\System Restore.exe" C:\Program Files\Common Files\System\ado\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    PID:2180
                    • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                      "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                      8⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2168
                    • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                      "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2188
                    • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                      "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                      8⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:1112
                    • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                      "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                      8⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3156
                    • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                      "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4624
                    • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                      8⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:584
                  • C:\Program Files\Common Files\System\de-DE\backup.exe
                    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1312
                  • C:\Program Files\Common Files\System\en-US\backup.exe
                    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                    7⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4976
                  • C:\Program Files\Common Files\System\es-ES\backup.exe
                    "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2484
                  • C:\Program Files\Common Files\System\fr-FR\backup.exe
                    "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                    7⤵
                      PID:512
                    • C:\Program Files\Common Files\System\it-IT\backup.exe
                      "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      PID:3484
                    • C:\Program Files\Common Files\System\msadc\backup.exe
                      "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                      7⤵
                      • Disables RegEdit via registry modification
                      • Drops file in Program Files directory
                      • System policy modification
                      PID:2392
                      • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                        "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:3236
                      • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                        "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:4936
                      • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                        "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:1992
                      • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                        "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                        8⤵
                          PID:932
                      • C:\Program Files\Common Files\System\ja-JP\backup.exe
                        "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                        7⤵
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:3188
                  • C:\Program Files\Google\backup.exe
                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                    5⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4088
                    • C:\Program Files\Google\Chrome\backup.exe
                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                      6⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious use of SetWindowsHookEx
                      PID:3448
                      • C:\Program Files\Google\Chrome\Application\backup.exe
                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1620
                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                          8⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          PID:3960
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                            9⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:3444
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                            9⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1108
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                            9⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1036
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\data.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                            9⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:3996
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                            9⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2068
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                            9⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1064
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                            9⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2876
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                            9⤵
                            • Disables RegEdit via registry modification
                            • Drops file in Program Files directory
                            PID:3052
                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                              10⤵
                              • Disables RegEdit via registry modification
                              • Drops file in Program Files directory
                              PID:3784
                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                11⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                PID:800
                        • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                          "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                          8⤵
                          • Executes dropped EXE
                          • System policy modification
                          PID:1844
                  • C:\Program Files\Internet Explorer\backup.exe
                    "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                    5⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:4692
                    • C:\Program Files\Internet Explorer\de-DE\backup.exe
                      "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                      6⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      PID:4208
                    • C:\Program Files\Internet Explorer\es-ES\backup.exe
                      "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                      6⤵
                        PID:2436
                      • C:\Program Files\Internet Explorer\it-IT\backup.exe
                        "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                        6⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:3684
                      • C:\Program Files\Internet Explorer\images\backup.exe
                        "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                        6⤵
                        • Disables RegEdit via registry modification
                        PID:4604
                      • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                        6⤵
                          PID:2008
                        • C:\Program Files\Internet Explorer\en-US\update.exe
                          "C:\Program Files\Internet Explorer\en-US\update.exe" C:\Program Files\Internet Explorer\en-US\
                          6⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:4012
                        • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                          "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                          6⤵
                            PID:4280
                        • C:\Program Files\Java\System Restore.exe
                          "C:\Program Files\Java\System Restore.exe" C:\Program Files\Java\
                          5⤵
                            PID:3752
                        • C:\Program Files (x86)\backup.exe
                          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                          4⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1868
                          • C:\Program Files (x86)\Adobe\backup.exe
                            "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                            5⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1452
                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              PID:4144
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\data.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1956
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:1116
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\update.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:600
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                    9⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2368
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\System Restore.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4444
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                    9⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:3912
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                  8⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:4984
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\data.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                  8⤵
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:4312
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                  8⤵
                                  • Disables RegEdit via registry modification
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:4184
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\System Restore.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                    9⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:4456
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:3980
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\update.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                    9⤵
                                    • Disables RegEdit via registry modification
                                    PID:3736
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • System policy modification
                                  PID:1112
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:2372
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                  8⤵
                                    PID:3300
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                  7⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • System policy modification
                                  PID:112
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Drops file in Program Files directory
                                    PID:344
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\update.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                      9⤵
                                      • Disables RegEdit via registry modification
                                      • System policy modification
                                      PID:2544
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • System policy modification
                                    PID:1296
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\update.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                    8⤵
                                    • System policy modification
                                    PID:4792
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                      9⤵
                                      • Disables RegEdit via registry modification
                                      • Drops file in Program Files directory
                                      • System policy modification
                                      PID:4428
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                        10⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:3984
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\System Restore.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                        10⤵
                                          PID:1460
                              • C:\Program Files (x86)\Common Files\data.exe
                                "C:\Program Files (x86)\Common Files\data.exe" C:\Program Files (x86)\Common Files\
                                5⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:3732
                                • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                  "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Drops file in Program Files directory
                                  PID:4036
                                  • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                    "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:1252
                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:1220
                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                      8⤵
                                        PID:4432
                                    • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                      "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Drops file in Program Files directory
                                      PID:2352
                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • System policy modification
                                        PID:2264
                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Drops file in Program Files directory
                                      PID:884
                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                        8⤵
                                          PID:4032
                                • C:\Users\backup.exe
                                  C:\Users\backup.exe C:\Users\
                                  4⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:2320
                                  • C:\Users\Admin\backup.exe
                                    C:\Users\Admin\backup.exe C:\Users\Admin\
                                    5⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:3464
                                    • C:\Users\Admin\3D Objects\backup.exe
                                      "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                      6⤵
                                      • System policy modification
                                      PID:2496
                                    • C:\Users\Admin\Contacts\backup.exe
                                      C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:3408
                                    • C:\Users\Admin\Downloads\backup.exe
                                      C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                      6⤵
                                      • System policy modification
                                      PID:2140
                                    • C:\Users\Admin\Favorites\backup.exe
                                      C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                      6⤵
                                        PID:1528
                                      • C:\Users\Admin\Documents\backup.exe
                                        C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                        6⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:4040
                                      • C:\Users\Admin\Desktop\backup.exe
                                        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                        6⤵
                                        • System policy modification
                                        PID:3948
                                      • C:\Users\Admin\Links\backup.exe
                                        C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                        6⤵
                                          PID:3568
                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2236
                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                  2⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4312
                                • C:\Users\Admin\AppData\Local\Temp\Low\data.exe
                                  C:\Users\Admin\AppData\Local\Temp\Low\data.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:628
                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                  2⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:288
                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:4168
                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:3420
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                1⤵
                                • Modifies visibility of file extensions in Explorer
                                • System policy modification
                                PID:728

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\PerfLogs\backup.exe
                                Filesize

                                72KB

                                MD5

                                8abccedb8536f1b44c0f680fb9f2b80b

                                SHA1

                                9c00807d07b97d6771b717879b578c41ebdc057e

                                SHA256

                                06611e31ee31f81e3932b48a9458302dc81a92dfaffcab2dcac36167d7b15823

                                SHA512

                                94e798d569387b1effe1d79037f354c74e5fa2afea8e7f7d781cb9ac4ea40d6c68b5ab365230b13da6e1afd53513bdd4c67d31e3c460c04ba48feefc1597fa0d

                                Download Submit

                              • C:\PerfLogs\backup.exe
                                Filesize

                                72KB

                                MD5

                                8abccedb8536f1b44c0f680fb9f2b80b

                                SHA1

                                9c00807d07b97d6771b717879b578c41ebdc057e

                                SHA256

                                06611e31ee31f81e3932b48a9458302dc81a92dfaffcab2dcac36167d7b15823

                                SHA512

                                94e798d569387b1effe1d79037f354c74e5fa2afea8e7f7d781cb9ac4ea40d6c68b5ab365230b13da6e1afd53513bdd4c67d31e3c460c04ba48feefc1597fa0d

                                Download Submit

                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\data.exe
                                Filesize

                                72KB

                                MD5

                                ca530c970918487e527de8f6afccaf87

                                SHA1

                                a6d7bae24d30f27fbcf7e98cf90e4243ffef161f

                                SHA256

                                1e33e368e9be7858e6d0a5de0848495bca86713b90d82bc2f12f9fae7d41ff82

                                SHA512

                                bad1e31b585b6edf449610151a73a1f3d9ef0a47c0494e2ea037493937dcb033289386bfeb04bcfe8e726c146064343f4c42fdc3a15b926b2460c08e55465cc4

                                Download Submit

                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\data.exe
                                Filesize

                                72KB

                                MD5

                                ca530c970918487e527de8f6afccaf87

                                SHA1

                                a6d7bae24d30f27fbcf7e98cf90e4243ffef161f

                                SHA256

                                1e33e368e9be7858e6d0a5de0848495bca86713b90d82bc2f12f9fae7d41ff82

                                SHA512

                                bad1e31b585b6edf449610151a73a1f3d9ef0a47c0494e2ea037493937dcb033289386bfeb04bcfe8e726c146064343f4c42fdc3a15b926b2460c08e55465cc4

                                Download Submit

                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                Filesize

                                72KB

                                MD5

                                de4fbd821f9dc6b74a71d888bc2d3aa8

                                SHA1

                                e213e199fd67e75701693c4bf874d0b17924d03f

                                SHA256

                                091e95dfdada18ee3e8eedaaf7a0bf469ec7a05627ed6f9d3f006da83c028512

                                SHA512

                                266f95bb04aeb04eccb32725bf4c552c25c5754941a67193f3b634f744139666ac6dacea956e750997274ead4f0512817c88a697c263f19520a3827d4e3ceffc

                                Download Submit

                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                Filesize

                                72KB

                                MD5

                                de4fbd821f9dc6b74a71d888bc2d3aa8

                                SHA1

                                e213e199fd67e75701693c4bf874d0b17924d03f

                                SHA256

                                091e95dfdada18ee3e8eedaaf7a0bf469ec7a05627ed6f9d3f006da83c028512

                                SHA512

                                266f95bb04aeb04eccb32725bf4c552c25c5754941a67193f3b634f744139666ac6dacea956e750997274ead4f0512817c88a697c263f19520a3827d4e3ceffc

                                Download Submit

                              • C:\Program Files (x86)\Adobe\backup.exe
                                Filesize

                                72KB

                                MD5

                                b0e3125b833e35e2da4a3808dd392598

                                SHA1

                                fcdd2f5a230110f1c24dc0b8834cacf4e2bfb705

                                SHA256

                                11fefb574d03b2f10af797b90d56074d80a816892bb75dec0eddc4f051f7e07b

                                SHA512

                                a5dd50c50db0642d58e32753eb116f69c4c5ddc24d563c441672ba4e04eb1d1ff99c8546196d04355f105425ef9f6e2fd6875c4041a97b64f6c305ece33944b1

                                Download Submit

                              • C:\Program Files (x86)\Adobe\backup.exe
                                Filesize

                                72KB

                                MD5

                                b0e3125b833e35e2da4a3808dd392598

                                SHA1

                                fcdd2f5a230110f1c24dc0b8834cacf4e2bfb705

                                SHA256

                                11fefb574d03b2f10af797b90d56074d80a816892bb75dec0eddc4f051f7e07b

                                SHA512

                                a5dd50c50db0642d58e32753eb116f69c4c5ddc24d563c441672ba4e04eb1d1ff99c8546196d04355f105425ef9f6e2fd6875c4041a97b64f6c305ece33944b1

                                Download Submit

                              • C:\Program Files (x86)\backup.exe
                                Filesize

                                72KB

                                MD5

                                034708bac48b7f7c46f895e573ab6699

                                SHA1

                                439294e0c2138bb3a2cd8054934ccd2253a1b66c

                                SHA256

                                f9b64daab13c0301ecffb0b94a596591ad8c8ddde716d3ef3d88d12eb301e681

                                SHA512

                                74b56441d72a6556be5e179da7d65454e6aed7ddb24cb78507b4fb1f0e7d3de6c23f8515b43c9e94deca700111650e762f8f2bbe87dc06bf69679a78d102f238

                                Download Submit

                              • C:\Program Files (x86)\backup.exe
                                Filesize

                                72KB

                                MD5

                                034708bac48b7f7c46f895e573ab6699

                                SHA1

                                439294e0c2138bb3a2cd8054934ccd2253a1b66c

                                SHA256

                                f9b64daab13c0301ecffb0b94a596591ad8c8ddde716d3ef3d88d12eb301e681

                                SHA512

                                74b56441d72a6556be5e179da7d65454e6aed7ddb24cb78507b4fb1f0e7d3de6c23f8515b43c9e94deca700111650e762f8f2bbe87dc06bf69679a78d102f238

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\backup.exe
                                Filesize

                                72KB

                                MD5

                                82e20c43d38f2761defef2d3bc4fb99d

                                SHA1

                                17e15fba2b5dc1550f20ce7f13cd5a693d87a12a

                                SHA256

                                2127e1c1b6636e82c0df6fdff0eab6625b96120135ef022ad8b9b57455930969

                                SHA512

                                f917b1460f6dde5a467a6fdca8b47ee74ba5d7d7ae1489a874fefafdc4be1f829af08b133b7bdbda07abbc72bbfb89fececf748b8da055d8843a753a913152b9

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\backup.exe
                                Filesize

                                72KB

                                MD5

                                82e20c43d38f2761defef2d3bc4fb99d

                                SHA1

                                17e15fba2b5dc1550f20ce7f13cd5a693d87a12a

                                SHA256

                                2127e1c1b6636e82c0df6fdff0eab6625b96120135ef022ad8b9b57455930969

                                SHA512

                                f917b1460f6dde5a467a6fdca8b47ee74ba5d7d7ae1489a874fefafdc4be1f829af08b133b7bdbda07abbc72bbfb89fececf748b8da055d8843a753a913152b9

                                Download Submit

                              • C:\Program Files\7-Zip\backup.exe
                                Filesize

                                72KB

                                MD5

                                0b493932306387d1774f4a7be0cc48f9

                                SHA1

                                b44eca6f1eb86bf393d09a363a05f402697e9690

                                SHA256

                                00061c126c6aed9ab12a8576bba8fbeedc63f7a49dfcd3d3339a0ea97dc9aca4

                                SHA512

                                b262392af31f31853173a37a1b70f317c88bb8ef81cc2bea3eb6243750074afd29633f07b27b0117abd18793d367f80daa394f26155d9bfda8ceef4def25a572

                                Download Submit

                              • C:\Program Files\7-Zip\backup.exe
                                Filesize

                                72KB

                                MD5

                                0b493932306387d1774f4a7be0cc48f9

                                SHA1

                                b44eca6f1eb86bf393d09a363a05f402697e9690

                                SHA256

                                00061c126c6aed9ab12a8576bba8fbeedc63f7a49dfcd3d3339a0ea97dc9aca4

                                SHA512

                                b262392af31f31853173a37a1b70f317c88bb8ef81cc2bea3eb6243750074afd29633f07b27b0117abd18793d367f80daa394f26155d9bfda8ceef4def25a572

                                Download Submit

                              • C:\Program Files\Common Files\DESIGNER\backup.exe
                                Filesize

                                72KB

                                MD5

                                0558ec927218988a474f026dce954d00

                                SHA1

                                1f492ce5fc37609b88af60f79767c164605ef9ec

                                SHA256

                                6ac9bd3bd1dd809bd3193160082911dd29327f6bb2a4ce09dbb554841e3146c2

                                SHA512

                                c0e595a3001c76e729a920fc8affdd86ecd6e6f8da7073c066657abcaa45d05c5e1e8fb3d105d61a9f5367af1ee484219f3950965c3961aeda85ee2f39056331

                                Download Submit

                              • C:\Program Files\Common Files\DESIGNER\backup.exe
                                Filesize

                                72KB

                                MD5

                                0558ec927218988a474f026dce954d00

                                SHA1

                                1f492ce5fc37609b88af60f79767c164605ef9ec

                                SHA256

                                6ac9bd3bd1dd809bd3193160082911dd29327f6bb2a4ce09dbb554841e3146c2

                                SHA512

                                c0e595a3001c76e729a920fc8affdd86ecd6e6f8da7073c066657abcaa45d05c5e1e8fb3d105d61a9f5367af1ee484219f3950965c3961aeda85ee2f39056331

                                Download Submit

                              • C:\Program Files\Common Files\Services\backup.exe
                                Filesize

                                72KB

                                MD5

                                cd3e5bf1416c67eee0edfaf59866d11b

                                SHA1

                                44ff020fd8ef919ffae41c69ffaf431dee4a8860

                                SHA256

                                fdbe008c55ac6a465fc6c04d6a8a61e6036cd7c6cfba2918032feb7c6adacaf7

                                SHA512

                                8bc6780cf0a19d77ee473fdf29f5258f06512d66a04359b28e6471bab74892c1479571d5059105c247fd3b5b3ddadeebd18a4a0789a215c4261289837ed2b255

                                Download Submit

                              • C:\Program Files\Common Files\Services\backup.exe
                                Filesize

                                72KB

                                MD5

                                cd3e5bf1416c67eee0edfaf59866d11b

                                SHA1

                                44ff020fd8ef919ffae41c69ffaf431dee4a8860

                                SHA256

                                fdbe008c55ac6a465fc6c04d6a8a61e6036cd7c6cfba2918032feb7c6adacaf7

                                SHA512

                                8bc6780cf0a19d77ee473fdf29f5258f06512d66a04359b28e6471bab74892c1479571d5059105c247fd3b5b3ddadeebd18a4a0789a215c4261289837ed2b255

                                Download Submit

                              • C:\Program Files\Common Files\System\ado\System Restore.exe
                                Filesize

                                72KB

                                MD5

                                9b26d9d36b4a8dbe4ddf574bf6270400

                                SHA1

                                121e38000c9157b8a26b99441fedc9e9e726a7cd

                                SHA256

                                e692a31e98323b33f94a81917f1c30206ff748e89f5993e027d1d06551b8466d

                                SHA512

                                a04612b8c2c69edb5ef3acc4f1e96ea141f3a1f659558be4aab24dae340087ae3061cba6e0b7d76a25ad962395c3e5464fc625fa819a1031ed108657c3052e55

                                Download Submit

                              • C:\Program Files\Common Files\System\ado\System Restore.exe
                                Filesize

                                72KB

                                MD5

                                9b26d9d36b4a8dbe4ddf574bf6270400

                                SHA1

                                121e38000c9157b8a26b99441fedc9e9e726a7cd

                                SHA256

                                e692a31e98323b33f94a81917f1c30206ff748e89f5993e027d1d06551b8466d

                                SHA512

                                a04612b8c2c69edb5ef3acc4f1e96ea141f3a1f659558be4aab24dae340087ae3061cba6e0b7d76a25ad962395c3e5464fc625fa819a1031ed108657c3052e55

                                Download Submit

                              • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                Filesize

                                72KB

                                MD5

                                301bf9a4ff7cc91f44fb6cf83efbfbf5

                                SHA1

                                fb1bdea5b5296a8577830e39a5bd172f7d61c00c

                                SHA256

                                3fffc2192c969de61bb3a3a45a09e9d5378fff260b75691c0afbe143e7812710

                                SHA512

                                16d087e5d90d7f47954bc17421eed259b46b2d7354612dbe6018e69377a598353793c33229e2106ff476a5cb21de9ed84df59e50449d69ff48cd6f97a55aa4e3

                                Download Submit

                              • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                Filesize

                                72KB

                                MD5

                                301bf9a4ff7cc91f44fb6cf83efbfbf5

                                SHA1

                                fb1bdea5b5296a8577830e39a5bd172f7d61c00c

                                SHA256

                                3fffc2192c969de61bb3a3a45a09e9d5378fff260b75691c0afbe143e7812710

                                SHA512

                                16d087e5d90d7f47954bc17421eed259b46b2d7354612dbe6018e69377a598353793c33229e2106ff476a5cb21de9ed84df59e50449d69ff48cd6f97a55aa4e3

                                Download Submit

                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                Filesize

                                72KB

                                MD5

                                cb1002ebf239a52bcbd35ebd6e3adbb3

                                SHA1

                                ae2feb58ae32308e7404c0b4e03b62e244800470

                                SHA256

                                148210a4b6b2871ec9c37cc98704e96bb9e2189056f9cfa47b7426a7cfb139fe

                                SHA512

                                573ba10f5f41d9409be35c72b725e92f51f65adedc2650577b9568c552dbb07048a70b4ad917cfb00ee29a1ac3aa31fc094930790b54fcf97114225db14fa86d

                                Download Submit

                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                Filesize

                                72KB

                                MD5

                                cb1002ebf239a52bcbd35ebd6e3adbb3

                                SHA1

                                ae2feb58ae32308e7404c0b4e03b62e244800470

                                SHA256

                                148210a4b6b2871ec9c37cc98704e96bb9e2189056f9cfa47b7426a7cfb139fe

                                SHA512

                                573ba10f5f41d9409be35c72b725e92f51f65adedc2650577b9568c552dbb07048a70b4ad917cfb00ee29a1ac3aa31fc094930790b54fcf97114225db14fa86d

                                Download Submit

                              • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                Filesize

                                72KB

                                MD5

                                cb1002ebf239a52bcbd35ebd6e3adbb3

                                SHA1

                                ae2feb58ae32308e7404c0b4e03b62e244800470

                                SHA256

                                148210a4b6b2871ec9c37cc98704e96bb9e2189056f9cfa47b7426a7cfb139fe

                                SHA512

                                573ba10f5f41d9409be35c72b725e92f51f65adedc2650577b9568c552dbb07048a70b4ad917cfb00ee29a1ac3aa31fc094930790b54fcf97114225db14fa86d

                                Download Submit

                              • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                Filesize

                                72KB

                                MD5

                                cb1002ebf239a52bcbd35ebd6e3adbb3

                                SHA1

                                ae2feb58ae32308e7404c0b4e03b62e244800470

                                SHA256

                                148210a4b6b2871ec9c37cc98704e96bb9e2189056f9cfa47b7426a7cfb139fe

                                SHA512

                                573ba10f5f41d9409be35c72b725e92f51f65adedc2650577b9568c552dbb07048a70b4ad917cfb00ee29a1ac3aa31fc094930790b54fcf97114225db14fa86d

                                Download Submit

                              • C:\Program Files\Common Files\System\backup.exe
                                Filesize

                                72KB

                                MD5

                                cd3e5bf1416c67eee0edfaf59866d11b

                                SHA1

                                44ff020fd8ef919ffae41c69ffaf431dee4a8860

                                SHA256

                                fdbe008c55ac6a465fc6c04d6a8a61e6036cd7c6cfba2918032feb7c6adacaf7

                                SHA512

                                8bc6780cf0a19d77ee473fdf29f5258f06512d66a04359b28e6471bab74892c1479571d5059105c247fd3b5b3ddadeebd18a4a0789a215c4261289837ed2b255

                                Download Submit

                              • C:\Program Files\Common Files\System\backup.exe
                                Filesize

                                72KB

                                MD5

                                cd3e5bf1416c67eee0edfaf59866d11b

                                SHA1

                                44ff020fd8ef919ffae41c69ffaf431dee4a8860

                                SHA256

                                fdbe008c55ac6a465fc6c04d6a8a61e6036cd7c6cfba2918032feb7c6adacaf7

                                SHA512

                                8bc6780cf0a19d77ee473fdf29f5258f06512d66a04359b28e6471bab74892c1479571d5059105c247fd3b5b3ddadeebd18a4a0789a215c4261289837ed2b255

                                Download Submit

                              • C:\Program Files\Common Files\backup.exe
                                Filesize

                                72KB

                                MD5

                                4b8815bb8a36156fb19e4c2a2555918e

                                SHA1

                                5f6e7dcceb07258de3122d6d74a4c8dff8211938

                                SHA256

                                7846ecdf3bfd9b9324fcd179b8eaec8a5031e3a969b81939926ccb441f816024

                                SHA512

                                8240341822b96f82a8b7baefbdeb6c436c0fbae32d1dbeec982d090a36a24be05a710d131c0caa13b18b06a23fd7c9146ddbbd11b80cae519d184589a785868c

                                Download Submit

                              • C:\Program Files\Common Files\backup.exe
                                Filesize

                                72KB

                                MD5

                                4b8815bb8a36156fb19e4c2a2555918e

                                SHA1

                                5f6e7dcceb07258de3122d6d74a4c8dff8211938

                                SHA256

                                7846ecdf3bfd9b9324fcd179b8eaec8a5031e3a969b81939926ccb441f816024

                                SHA512

                                8240341822b96f82a8b7baefbdeb6c436c0fbae32d1dbeec982d090a36a24be05a710d131c0caa13b18b06a23fd7c9146ddbbd11b80cae519d184589a785868c

                                Download Submit

                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                Filesize

                                72KB

                                MD5

                                9be67a61825a838dfe61aa6945c51825

                                SHA1

                                2c60734b53e687475ef957f1b0be50c42ec3d61c

                                SHA256

                                87f4b10419381abcffbc8235ac6a8c7a2302bd59ae67ccc4fe36753cb85d05ec

                                SHA512

                                4592314e1e897b1df7afc265de30797517b91b79ab090ae9685127958d39e36f291ca94ea5c5f911b6fc5da836a39bc83facecbb94494812206d0dc5e7364a0a

                                Download Submit

                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                Filesize

                                72KB

                                MD5

                                9be67a61825a838dfe61aa6945c51825

                                SHA1

                                2c60734b53e687475ef957f1b0be50c42ec3d61c

                                SHA256

                                87f4b10419381abcffbc8235ac6a8c7a2302bd59ae67ccc4fe36753cb85d05ec

                                SHA512

                                4592314e1e897b1df7afc265de30797517b91b79ab090ae9685127958d39e36f291ca94ea5c5f911b6fc5da836a39bc83facecbb94494812206d0dc5e7364a0a

                                Download Submit

                              • C:\Program Files\Common Files\microsoft shared\backup.exe
                                Filesize

                                72KB

                                MD5

                                3719f4beabd09c056e28e4a0c60e793d

                                SHA1

                                6c61a3703c1e950801df401f855b5aa05762c461

                                SHA256

                                1f460eccf4a4c3084a4e63a2b2ba1e7b8af98a5fc836dfe904b4cf242ff4ff36

                                SHA512

                                39d2f1831cc3e5f41a8b6bce646aac6932dc3fdfb288c52d5491224724fc26c20e4e884c318737e6723f3e13ed55a9408aed2a63ba125af3dde0dff366425bba

                                Download Submit

                              • C:\Program Files\Common Files\microsoft shared\backup.exe
                                Filesize

                                72KB

                                MD5

                                3719f4beabd09c056e28e4a0c60e793d

                                SHA1

                                6c61a3703c1e950801df401f855b5aa05762c461

                                SHA256

                                1f460eccf4a4c3084a4e63a2b2ba1e7b8af98a5fc836dfe904b4cf242ff4ff36

                                SHA512

                                39d2f1831cc3e5f41a8b6bce646aac6932dc3fdfb288c52d5491224724fc26c20e4e884c318737e6723f3e13ed55a9408aed2a63ba125af3dde0dff366425bba

                                Download Submit

                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                Filesize

                                72KB

                                MD5

                                f8a4581412026f35d94297c361332325

                                SHA1

                                926fee9b3504b55faeab06e78c6b58869c842ab0

                                SHA256

                                cdb09077c4a89302d205f09e14ae7418e1fcee188857aa4d1c8b9f0b230b79d6

                                SHA512

                                4409e1b3281a139ebdd6debb91d4211fb95f57e340d2c7df40a6beb51bb6d164feb34e445a8e1329af983c091f509187916d8d1b2ba702fd18021dfe20952c2e

                                Download Submit

                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                Filesize

                                72KB

                                MD5

                                f8a4581412026f35d94297c361332325

                                SHA1

                                926fee9b3504b55faeab06e78c6b58869c842ab0

                                SHA256

                                cdb09077c4a89302d205f09e14ae7418e1fcee188857aa4d1c8b9f0b230b79d6

                                SHA512

                                4409e1b3281a139ebdd6debb91d4211fb95f57e340d2c7df40a6beb51bb6d164feb34e445a8e1329af983c091f509187916d8d1b2ba702fd18021dfe20952c2e

                                Download Submit

                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                Filesize

                                72KB

                                MD5

                                b9364d6f9bc1ea17bcb572af91280cb6

                                SHA1

                                524d907315f41c1e419c771ad5822651e7569637

                                SHA256

                                61e4fb382184672d7b74874852ea325345d2957c728532e8fc29fbc3a7391440

                                SHA512

                                252ecc026ef93b8fb015b1a41f0e4c9d9dbb746a3bb621a088ba3dd9a69aebeedfd70736d1f01d9f72525c77b5003b6d2f5fd88344d9e3ac1d7bc54fd8413963

                                Download Submit

                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                Filesize

                                72KB

                                MD5

                                b9364d6f9bc1ea17bcb572af91280cb6

                                SHA1

                                524d907315f41c1e419c771ad5822651e7569637

                                SHA256

                                61e4fb382184672d7b74874852ea325345d2957c728532e8fc29fbc3a7391440

                                SHA512

                                252ecc026ef93b8fb015b1a41f0e4c9d9dbb746a3bb621a088ba3dd9a69aebeedfd70736d1f01d9f72525c77b5003b6d2f5fd88344d9e3ac1d7bc54fd8413963

                                Download Submit

                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                Filesize

                                72KB

                                MD5

                                a53d69b8763a0a8a9508a9cf4f45ca43

                                SHA1

                                ee0e449466afc00d1fdfa81000eae90624b45e1a

                                SHA256

                                bb98858a9d5ea4fae62d4613eab8e52c0e889d6e38a047aa9927276c1af1936d

                                SHA512

                                56cc449f27fdb2216d4d1e8d52bd98dd44af0a28f17bfc4d7c74cd5dd597502adfa21007919e4a948e2668d04c88bc4da3cf343ea13c7f015cf613e515f165b2

                                Download Submit

                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                Filesize

                                72KB

                                MD5

                                a53d69b8763a0a8a9508a9cf4f45ca43

                                SHA1

                                ee0e449466afc00d1fdfa81000eae90624b45e1a

                                SHA256

                                bb98858a9d5ea4fae62d4613eab8e52c0e889d6e38a047aa9927276c1af1936d

                                SHA512

                                56cc449f27fdb2216d4d1e8d52bd98dd44af0a28f17bfc4d7c74cd5dd597502adfa21007919e4a948e2668d04c88bc4da3cf343ea13c7f015cf613e515f165b2

                                Download Submit

                              • C:\Program Files\Google\Chrome\backup.exe
                                Filesize

                                72KB

                                MD5

                                b5381ac2f818ab3befb37b315e92c375

                                SHA1

                                0c3ec6f6828280a54ea0e8b17456ac77ba3ed157

                                SHA256

                                cfb23864c41a811910acd53c71df8909d184eee0f27bc242fc20d74d85df1b88

                                SHA512

                                22baa6ff7441f68bd90a01dd6b2355bf850b2af6831ee3dca3f12033bceada221c8ef1b54cf68677d71a4e07484efd8e3ddaf8ea22d2ee5e66f14d2b08585bbf

                                Download Submit

                              • C:\Program Files\Google\Chrome\backup.exe
                                Filesize

                                72KB

                                MD5

                                b5381ac2f818ab3befb37b315e92c375

                                SHA1

                                0c3ec6f6828280a54ea0e8b17456ac77ba3ed157

                                SHA256

                                cfb23864c41a811910acd53c71df8909d184eee0f27bc242fc20d74d85df1b88

                                SHA512

                                22baa6ff7441f68bd90a01dd6b2355bf850b2af6831ee3dca3f12033bceada221c8ef1b54cf68677d71a4e07484efd8e3ddaf8ea22d2ee5e66f14d2b08585bbf

                                Download Submit

                              • C:\Program Files\Google\backup.exe
                                Filesize

                                72KB

                                MD5

                                a32b3a44105d0b3ddb1ae8b938e1b53f

                                SHA1

                                6e1629388d691e9fd4a3a69833bed5af3bdf7ea9

                                SHA256

                                64cb0310deae0eb9c7450f71f77a2c160e44f94154f489d342ca952d46f81e2f

                                SHA512

                                c7c9000d5cc9afe1654a4c20ec12984f5292c1a0f64ad52bc57d42b0a10b8f27179f5c14587a87d64ce9f2651166e09bf1f1c91e21557b2a5703c6e8bcd3d5c7

                                Download Submit

                              • C:\Program Files\Google\backup.exe
                                Filesize

                                72KB

                                MD5

                                a32b3a44105d0b3ddb1ae8b938e1b53f

                                SHA1

                                6e1629388d691e9fd4a3a69833bed5af3bdf7ea9

                                SHA256

                                64cb0310deae0eb9c7450f71f77a2c160e44f94154f489d342ca952d46f81e2f

                                SHA512

                                c7c9000d5cc9afe1654a4c20ec12984f5292c1a0f64ad52bc57d42b0a10b8f27179f5c14587a87d64ce9f2651166e09bf1f1c91e21557b2a5703c6e8bcd3d5c7

                                Download Submit

                              • C:\Program Files\backup.exe
                                Filesize

                                72KB

                                MD5

                                8abccedb8536f1b44c0f680fb9f2b80b

                                SHA1

                                9c00807d07b97d6771b717879b578c41ebdc057e

                                SHA256

                                06611e31ee31f81e3932b48a9458302dc81a92dfaffcab2dcac36167d7b15823

                                SHA512

                                94e798d569387b1effe1d79037f354c74e5fa2afea8e7f7d781cb9ac4ea40d6c68b5ab365230b13da6e1afd53513bdd4c67d31e3c460c04ba48feefc1597fa0d

                                Download Submit

                              • C:\Program Files\backup.exe
                                Filesize

                                72KB

                                MD5

                                8abccedb8536f1b44c0f680fb9f2b80b

                                SHA1

                                9c00807d07b97d6771b717879b578c41ebdc057e

                                SHA256

                                06611e31ee31f81e3932b48a9458302dc81a92dfaffcab2dcac36167d7b15823

                                SHA512

                                94e798d569387b1effe1d79037f354c74e5fa2afea8e7f7d781cb9ac4ea40d6c68b5ab365230b13da6e1afd53513bdd4c67d31e3c460c04ba48feefc1597fa0d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1180827999\backup.exe
                                Filesize

                                72KB

                                MD5

                                1af86a4e2321a1a997bbf5afcf8b003c

                                SHA1

                                e8f6e8826927c0d2bc447aafbbdaca277302a06c

                                SHA256

                                2b4719502354aea112dccc7420085e9562c11587a6e56c763feceb402ecb4e8e

                                SHA512

                                7d54c4111f25bc2d6d8fab0cf71bf74cc63957c61e2b8e5fb92e7d0330d239f030d1b69a093e1060ad37fca3acf2d5cad4f6bf8b5d87676cb1f87d7f6d03dccf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1180827999\backup.exe
                                Filesize

                                72KB

                                MD5

                                1af86a4e2321a1a997bbf5afcf8b003c

                                SHA1

                                e8f6e8826927c0d2bc447aafbbdaca277302a06c

                                SHA256

                                2b4719502354aea112dccc7420085e9562c11587a6e56c763feceb402ecb4e8e

                                SHA512

                                7d54c4111f25bc2d6d8fab0cf71bf74cc63957c61e2b8e5fb92e7d0330d239f030d1b69a093e1060ad37fca3acf2d5cad4f6bf8b5d87676cb1f87d7f6d03dccf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Low\data.exe
                                Filesize

                                72KB

                                MD5

                                1af86a4e2321a1a997bbf5afcf8b003c

                                SHA1

                                e8f6e8826927c0d2bc447aafbbdaca277302a06c

                                SHA256

                                2b4719502354aea112dccc7420085e9562c11587a6e56c763feceb402ecb4e8e

                                SHA512

                                7d54c4111f25bc2d6d8fab0cf71bf74cc63957c61e2b8e5fb92e7d0330d239f030d1b69a093e1060ad37fca3acf2d5cad4f6bf8b5d87676cb1f87d7f6d03dccf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Low\data.exe
                                Filesize

                                72KB

                                MD5

                                1af86a4e2321a1a997bbf5afcf8b003c

                                SHA1

                                e8f6e8826927c0d2bc447aafbbdaca277302a06c

                                SHA256

                                2b4719502354aea112dccc7420085e9562c11587a6e56c763feceb402ecb4e8e

                                SHA512

                                7d54c4111f25bc2d6d8fab0cf71bf74cc63957c61e2b8e5fb92e7d0330d239f030d1b69a093e1060ad37fca3acf2d5cad4f6bf8b5d87676cb1f87d7f6d03dccf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                Filesize

                                72KB

                                MD5

                                dbc0e501ad578e2421b0ea4e5f2757cf

                                SHA1

                                85d3e4e0382b4d8109c4ea72396eb2b8684e7316

                                SHA256

                                818f5676122dc94b23b6b9edc7f79817017aa4941174e4cc9ee1a12776cb22d4

                                SHA512

                                5418dba807449455171e2a6fca71ce3bf504b3b886631f959ec127931bad8520d61efafb2818a515137909842c423cfdab7d81589f26755ceaeb9791737496b2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                Filesize

                                72KB

                                MD5

                                dbc0e501ad578e2421b0ea4e5f2757cf

                                SHA1

                                85d3e4e0382b4d8109c4ea72396eb2b8684e7316

                                SHA256

                                818f5676122dc94b23b6b9edc7f79817017aa4941174e4cc9ee1a12776cb22d4

                                SHA512

                                5418dba807449455171e2a6fca71ce3bf504b3b886631f959ec127931bad8520d61efafb2818a515137909842c423cfdab7d81589f26755ceaeb9791737496b2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                Filesize

                                72KB

                                MD5

                                dbc0e501ad578e2421b0ea4e5f2757cf

                                SHA1

                                85d3e4e0382b4d8109c4ea72396eb2b8684e7316

                                SHA256

                                818f5676122dc94b23b6b9edc7f79817017aa4941174e4cc9ee1a12776cb22d4

                                SHA512

                                5418dba807449455171e2a6fca71ce3bf504b3b886631f959ec127931bad8520d61efafb2818a515137909842c423cfdab7d81589f26755ceaeb9791737496b2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                Filesize

                                72KB

                                MD5

                                dbc0e501ad578e2421b0ea4e5f2757cf

                                SHA1

                                85d3e4e0382b4d8109c4ea72396eb2b8684e7316

                                SHA256

                                818f5676122dc94b23b6b9edc7f79817017aa4941174e4cc9ee1a12776cb22d4

                                SHA512

                                5418dba807449455171e2a6fca71ce3bf504b3b886631f959ec127931bad8520d61efafb2818a515137909842c423cfdab7d81589f26755ceaeb9791737496b2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                Filesize

                                72KB

                                MD5

                                1af86a4e2321a1a997bbf5afcf8b003c

                                SHA1

                                e8f6e8826927c0d2bc447aafbbdaca277302a06c

                                SHA256

                                2b4719502354aea112dccc7420085e9562c11587a6e56c763feceb402ecb4e8e

                                SHA512

                                7d54c4111f25bc2d6d8fab0cf71bf74cc63957c61e2b8e5fb92e7d0330d239f030d1b69a093e1060ad37fca3acf2d5cad4f6bf8b5d87676cb1f87d7f6d03dccf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                Filesize

                                72KB

                                MD5

                                1af86a4e2321a1a997bbf5afcf8b003c

                                SHA1

                                e8f6e8826927c0d2bc447aafbbdaca277302a06c

                                SHA256

                                2b4719502354aea112dccc7420085e9562c11587a6e56c763feceb402ecb4e8e

                                SHA512

                                7d54c4111f25bc2d6d8fab0cf71bf74cc63957c61e2b8e5fb92e7d0330d239f030d1b69a093e1060ad37fca3acf2d5cad4f6bf8b5d87676cb1f87d7f6d03dccf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                Filesize

                                72KB

                                MD5

                                1af86a4e2321a1a997bbf5afcf8b003c

                                SHA1

                                e8f6e8826927c0d2bc447aafbbdaca277302a06c

                                SHA256

                                2b4719502354aea112dccc7420085e9562c11587a6e56c763feceb402ecb4e8e

                                SHA512

                                7d54c4111f25bc2d6d8fab0cf71bf74cc63957c61e2b8e5fb92e7d0330d239f030d1b69a093e1060ad37fca3acf2d5cad4f6bf8b5d87676cb1f87d7f6d03dccf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                Filesize

                                72KB

                                MD5

                                1af86a4e2321a1a997bbf5afcf8b003c

                                SHA1

                                e8f6e8826927c0d2bc447aafbbdaca277302a06c

                                SHA256

                                2b4719502354aea112dccc7420085e9562c11587a6e56c763feceb402ecb4e8e

                                SHA512

                                7d54c4111f25bc2d6d8fab0cf71bf74cc63957c61e2b8e5fb92e7d0330d239f030d1b69a093e1060ad37fca3acf2d5cad4f6bf8b5d87676cb1f87d7f6d03dccf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                Filesize

                                72KB

                                MD5

                                dbc0e501ad578e2421b0ea4e5f2757cf

                                SHA1

                                85d3e4e0382b4d8109c4ea72396eb2b8684e7316

                                SHA256

                                818f5676122dc94b23b6b9edc7f79817017aa4941174e4cc9ee1a12776cb22d4

                                SHA512

                                5418dba807449455171e2a6fca71ce3bf504b3b886631f959ec127931bad8520d61efafb2818a515137909842c423cfdab7d81589f26755ceaeb9791737496b2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                Filesize

                                72KB

                                MD5

                                dbc0e501ad578e2421b0ea4e5f2757cf

                                SHA1

                                85d3e4e0382b4d8109c4ea72396eb2b8684e7316

                                SHA256

                                818f5676122dc94b23b6b9edc7f79817017aa4941174e4cc9ee1a12776cb22d4

                                SHA512

                                5418dba807449455171e2a6fca71ce3bf504b3b886631f959ec127931bad8520d61efafb2818a515137909842c423cfdab7d81589f26755ceaeb9791737496b2

                                Download Submit

                              • C:\backup.exe
                                Filesize

                                72KB

                                MD5

                                874ed41d82093537388ca00cdce60733

                                SHA1

                                beb2b7d1e57df5dac3cb4b01a3176682bfbe0776

                                SHA256

                                b97feaf1821c536bc31fa6444660f1f71a3a24af025117a7c482931b9e04ce9b

                                SHA512

                                1edfb073f83ecd0b7defa1e406e1c5b5f5dfa25315b1eba0f4f06c9727d3deae70ce2cc12e8dfb7665baa89c9fc59f11f767396913d3b1c0b8967c530dfe837d

                                Download Submit

                              • C:\backup.exe
                                Filesize

                                72KB

                                MD5

                                874ed41d82093537388ca00cdce60733

                                SHA1

                                beb2b7d1e57df5dac3cb4b01a3176682bfbe0776

                                SHA256

                                b97feaf1821c536bc31fa6444660f1f71a3a24af025117a7c482931b9e04ce9b

                                SHA512

                                1edfb073f83ecd0b7defa1e406e1c5b5f5dfa25315b1eba0f4f06c9727d3deae70ce2cc12e8dfb7665baa89c9fc59f11f767396913d3b1c0b8967c530dfe837d

                                Download Submit

                              • C:\odt\backup.exe
                                Filesize

                                72KB

                                MD5

                                8abccedb8536f1b44c0f680fb9f2b80b

                                SHA1

                                9c00807d07b97d6771b717879b578c41ebdc057e

                                SHA256

                                06611e31ee31f81e3932b48a9458302dc81a92dfaffcab2dcac36167d7b15823

                                SHA512

                                94e798d569387b1effe1d79037f354c74e5fa2afea8e7f7d781cb9ac4ea40d6c68b5ab365230b13da6e1afd53513bdd4c67d31e3c460c04ba48feefc1597fa0d

                                Download Submit

                              • C:\odt\backup.exe
                                Filesize

                                72KB

                                MD5

                                8abccedb8536f1b44c0f680fb9f2b80b

                                SHA1

                                9c00807d07b97d6771b717879b578c41ebdc057e

                                SHA256

                                06611e31ee31f81e3932b48a9458302dc81a92dfaffcab2dcac36167d7b15823

                                SHA512

                                94e798d569387b1effe1d79037f354c74e5fa2afea8e7f7d781cb9ac4ea40d6c68b5ab365230b13da6e1afd53513bdd4c67d31e3c460c04ba48feefc1597fa0d

                                Download Submit