Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    184s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 00:32

General

  • Target

    bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe

  • Size

    72KB

  • MD5

    0fea0bbb1ea050b843d9c47ecf6c90f0

  • SHA1

    97dad33402ade98f52cf8fac1d2834e63afcd5f7

  • SHA256

    bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0

  • SHA512

    d1fe4db5c4c47312035fd8d59b4eaa2f1027c31635ad2e3e54027932098eff646d8bf9c9b11b2d3b0b04358d5d31a96262b82665544f0cc9363e8cabcc1068cd

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2B:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPV

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe
    "C:\Users\Admin\AppData\Local\Temp\bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1408
    • C:\Users\Admin\AppData\Local\Temp\976864069\backup.exe
      C:\Users\Admin\AppData\Local\Temp\976864069\backup.exe C:\Users\Admin\AppData\Local\Temp\976864069\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2576
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3088
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:4112
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1460
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1972
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2172
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3468
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3508
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1004
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4024
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4796
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\data.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3456
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4964
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3628
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3708
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:5068
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1620
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:524
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2620
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3524
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4524
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2188
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1340
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4776
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4084
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2140
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1476
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1828
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4168
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\update.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1500
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1660
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1096
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:924
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1108
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2744
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4360
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4280
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3768
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3180
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\data.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:456
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1532
                • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:5116
                • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:5000
                • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3064
                • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:3240
                • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                  8⤵
                    PID:4092
                  • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                    8⤵
                    • System policy modification
                    PID:4632
                  • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\update.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\update.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:2428
                  • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:1936
                  • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\update.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\update.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                    8⤵
                      PID:2548
                    • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                      8⤵
                      • System policy modification
                      PID:460
                    • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                      8⤵
                      • System policy modification
                      PID:2376
                    • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      PID:1652
                    • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                      8⤵
                      • System policy modification
                      PID:3700
                    • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      PID:116
                    • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:3088
                    • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                      8⤵
                        PID:4712
                      • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                        8⤵
                          PID:1884
                        • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          PID:3384
                        • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                          8⤵
                          • System policy modification
                          PID:968
                        • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                          8⤵
                            PID:3628
                          • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                            8⤵
                            • System policy modification
                            PID:2700
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\data.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                          7⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:424
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1528
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                            8⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:4828
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                            8⤵
                              PID:1920
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                              8⤵
                                PID:3604
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                PID:3564
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                8⤵
                                  PID:1424
                              • C:\Program Files\Common Files\microsoft shared\OFFICE16\System Restore.exe
                                "C:\Program Files\Common Files\microsoft shared\OFFICE16\System Restore.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                7⤵
                                  PID:5056
                                  • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                    8⤵
                                      PID:2792
                                  • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                    7⤵
                                    • System policy modification
                                    PID:1368
                                  • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    PID:1160
                                  • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                    7⤵
                                      PID:2320
                                    • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                      7⤵
                                      • Disables RegEdit via registry modification
                                      PID:3248
                                      • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\data.exe
                                        "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                        8⤵
                                        • Disables RegEdit via registry modification
                                        PID:4732
                                    • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                      7⤵
                                        PID:1736
                                        • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          PID:4840
                                      • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                        7⤵
                                          PID:3904
                                        • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                          7⤵
                                            PID:4380
                                          • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                            7⤵
                                            • Drops file in Program Files directory
                                            PID:4596
                                            • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                              8⤵
                                                PID:1368
                                                • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\update.exe
                                                  "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\update.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                  9⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  PID:2300
                                          • C:\Program Files\Common Files\Services\backup.exe
                                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:4052
                                          • C:\Program Files\Common Files\System\backup.exe
                                            "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                            6⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3056
                                            • C:\Program Files\Common Files\System\ado\backup.exe
                                              "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                              7⤵
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • Suspicious use of SetWindowsHookEx
                                              PID:3088
                                              • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                8⤵
                                                  PID:3552
                                                • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                  8⤵
                                                  • System policy modification
                                                  PID:4704
                                                • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                  8⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • System policy modification
                                                  PID:3664
                                                • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                  8⤵
                                                    PID:5052
                                                  • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                    8⤵
                                                    • System policy modification
                                                    PID:2448
                                                  • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                    8⤵
                                                      PID:1412
                                                  • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                    7⤵
                                                      PID:776
                                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                      7⤵
                                                        PID:2996
                                                      • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                        7⤵
                                                          PID:788
                                                        • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                          "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                          7⤵
                                                          • Disables RegEdit via registry modification
                                                          PID:5116
                                                        • C:\Program Files\Common Files\System\it-IT\data.exe
                                                          "C:\Program Files\Common Files\System\it-IT\data.exe" C:\Program Files\Common Files\System\it-IT\
                                                          7⤵
                                                            PID:3232
                                                          • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                            "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                            7⤵
                                                              PID:3872
                                                            • C:\Program Files\Common Files\System\msadc\backup.exe
                                                              "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                              7⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Drops file in Program Files directory
                                                              PID:4868
                                                              • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                8⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:4704
                                                              • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                8⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:1560
                                                              • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:5108
                                                              • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:676
                                                              • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                8⤵
                                                                  PID:1476
                                                                • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                  8⤵
                                                                    PID:3832
                                                                • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                  7⤵
                                                                  • Drops file in Program Files directory
                                                                  PID:1424
                                                                  • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                    "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                    8⤵
                                                                      PID:4832
                                                                    • C:\Program Files\Common Files\System\Ole DB\en-US\System Restore.exe
                                                                      "C:\Program Files\Common Files\System\Ole DB\en-US\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                      8⤵
                                                                        PID:636
                                                                      • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                        "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                        8⤵
                                                                          PID:4704
                                                                  • C:\Program Files\Google\backup.exe
                                                                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2924
                                                                    • C:\Program Files\Google\Chrome\backup.exe
                                                                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                      6⤵
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:5104
                                                                      • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                        7⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:4752
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • Drops file in Program Files directory
                                                                          PID:1704
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System policy modification
                                                                            PID:3756
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System policy modification
                                                                            PID:4012
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:2968
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\update.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:2584
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:3488
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:1636
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                            9⤵
                                                                              PID:1856
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Drops file in Program Files directory
                                                                              PID:1108
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                10⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:3180
                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\System Restore.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                  11⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  PID:4904
                                                                          • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                            8⤵
                                                                              PID:4148
                                                                          • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe
                                                                            "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                            7⤵
                                                                              PID:1576
                                                                        • C:\Program Files\Internet Explorer\backup.exe
                                                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                          5⤵
                                                                          • Disables RegEdit via registry modification
                                                                          PID:4136
                                                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                            6⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • System policy modification
                                                                            PID:5020
                                                                          • C:\Program Files\Internet Explorer\en-US\update.exe
                                                                            "C:\Program Files\Internet Explorer\en-US\update.exe" C:\Program Files\Internet Explorer\en-US\
                                                                            6⤵
                                                                              PID:1708
                                                                            • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                              "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                              6⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • System policy modification
                                                                              PID:4596
                                                                            • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                              "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                              6⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • System policy modification
                                                                              PID:3076
                                                                            • C:\Program Files\Internet Explorer\images\backup.exe
                                                                              "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                              6⤵
                                                                                PID:3848
                                                                              • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                6⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                PID:2924
                                                                              • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                6⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System policy modification
                                                                                PID:2696
                                                                              • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                6⤵
                                                                                • Disables RegEdit via registry modification
                                                                                • System policy modification
                                                                                PID:4920
                                                                            • C:\Program Files\Java\backup.exe
                                                                              "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                              5⤵
                                                                                PID:224
                                                                                • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                  6⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Drops file in Program Files directory
                                                                                  PID:4756
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                    7⤵
                                                                                      PID:1340
                                                                                    • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                      "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                      7⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:2960
                                                                                      • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                        "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                        8⤵
                                                                                          PID:972
                                                                                        • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                          "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                          8⤵
                                                                                            PID:424
                                                                                        • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                          "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                          7⤵
                                                                                            PID:3424
                                                                                            • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                              "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:3560
                                                                                              • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                9⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • System policy modification
                                                                                                PID:3552
                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\update.exe
                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\update.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                            7⤵
                                                                                              PID:2204
                                                                                          • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                            "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                            6⤵
                                                                                            • Drops file in Program Files directory
                                                                                            PID:3136
                                                                                            • C:\Program Files\Java\jre1.8.0_66\bin\data.exe
                                                                                              "C:\Program Files\Java\jre1.8.0_66\bin\data.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                              7⤵
                                                                                              • Drops file in Program Files directory
                                                                                              PID:4588
                                                                                              • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\update.exe
                                                                                                "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\update.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                8⤵
                                                                                                  PID:4600
                                                                                                • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\data.exe
                                                                                                  "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\data.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                  8⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:4696
                                                                                          • C:\Program Files\Microsoft Office\backup.exe
                                                                                            "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                            5⤵
                                                                                            • Drops file in Program Files directory
                                                                                            PID:1404
                                                                                            • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                              "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                              6⤵
                                                                                                PID:2816
                                                                                              • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                6⤵
                                                                                                • System policy modification
                                                                                                PID:3968
                                                                                              • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                                "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                                6⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                • System policy modification
                                                                                                PID:3544
                                                                                                • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                  "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                  7⤵
                                                                                                    PID:2540
                                                                                                  • C:\Program Files\Microsoft Office\root\Client\update.exe
                                                                                                    "C:\Program Files\Microsoft Office\root\Client\update.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                    7⤵
                                                                                                      PID:3472
                                                                                                • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                  "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                  5⤵
                                                                                                    PID:4816
                                                                                                    • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                                                      "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                                      6⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:1452
                                                                                                  • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                    5⤵
                                                                                                      PID:2752
                                                                                                  • C:\Program Files (x86)\backup.exe
                                                                                                    "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System policy modification
                                                                                                    PID:1456
                                                                                                    • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                      5⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:448
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                        6⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:2432
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                          7⤵
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:4732
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                          7⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in Program Files directory
                                                                                                          PID:1748
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                            8⤵
                                                                                                            • System policy modification
                                                                                                            PID:3580
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                              9⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              PID:4876
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\update.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                            8⤵
                                                                                                            • Drops file in Program Files directory
                                                                                                            • System policy modification
                                                                                                            PID:936
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                              9⤵
                                                                                                                PID:2760
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                              8⤵
                                                                                                                PID:408
                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                8⤵
                                                                                                                  PID:2932
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                  8⤵
                                                                                                                    PID:2136
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                      9⤵
                                                                                                                      • System policy modification
                                                                                                                      PID:1032
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                    8⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:1100
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                      9⤵
                                                                                                                        PID:332
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                      8⤵
                                                                                                                        PID:1292
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\update.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                        8⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        PID:2720
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                          9⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:1396
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                        8⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        PID:1452
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                          9⤵
                                                                                                                            PID:1716
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                          8⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:3780
                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                            9⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            PID:4192
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                              10⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:1380
                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                            9⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            PID:2768
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                          8⤵
                                                                                                                            PID:3512
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                              9⤵
                                                                                                                              • System policy modification
                                                                                                                              PID:1828
                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\update.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                            8⤵
                                                                                                                              PID:3292
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                              8⤵
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              PID:2340
                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\data.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                            7⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:1504
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                              8⤵
                                                                                                                                PID:3364
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                  9⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • System policy modification
                                                                                                                                  PID:4080
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                8⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                PID:4280
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                8⤵
                                                                                                                                  PID:1352
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\update.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                    9⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    • System policy modification
                                                                                                                                    PID:3444
                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                      10⤵
                                                                                                                                      • System policy modification
                                                                                                                                      PID:4992
                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                      10⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      PID:556
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                        11⤵
                                                                                                                                          PID:2924
                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                          11⤵
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • System policy modification
                                                                                                                                          PID:2032
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                  7⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  PID:4972
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                    8⤵
                                                                                                                                      PID:4204
                                                                                                                              • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                5⤵
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                PID:2704
                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                  6⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  PID:4948
                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                    7⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    PID:4832
                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                    7⤵
                                                                                                                                      PID:4736
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                        8⤵
                                                                                                                                        • System policy modification
                                                                                                                                        PID:4340
                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                      7⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      PID:2188
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                        8⤵
                                                                                                                                          PID:2996
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                        7⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • System policy modification
                                                                                                                                        PID:3588
                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                          8⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          PID:2596
                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                            9⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            PID:2740
                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                              10⤵
                                                                                                                                                PID:2416
                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                                10⤵
                                                                                                                                                  PID:3116
                                                                                                                                        • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                          6⤵
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:2668
                                                                                                                                          • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                            7⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            PID:3632
                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                          6⤵
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:408
                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                            7⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            PID:3488
                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                            7⤵
                                                                                                                                              PID:4680
                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                              7⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              PID:3996
                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                8⤵
                                                                                                                                                  PID:2452
                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                                  8⤵
                                                                                                                                                    PID:692
                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                                    8⤵
                                                                                                                                                      PID:1856
                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\
                                                                                                                                                    7⤵
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    PID:1732
                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\
                                                                                                                                                      8⤵
                                                                                                                                                        PID:1500
                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\
                                                                                                                                                      7⤵
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      PID:4852
                                                                                                                                                  • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                    6⤵
                                                                                                                                                      PID:4248
                                                                                                                                                    • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                      6⤵
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:2644
                                                                                                                                                      • C:\Program Files (x86)\Common Files\System\ado\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
                                                                                                                                                        7⤵
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:4460
                                                                                                                                                  • C:\Program Files (x86)\Google\data.exe
                                                                                                                                                    "C:\Program Files (x86)\Google\data.exe" C:\Program Files (x86)\Google\
                                                                                                                                                    5⤵
                                                                                                                                                      PID:5048
                                                                                                                                                      • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                        6⤵
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:4420
                                                                                                                                                      • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                        6⤵
                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                        PID:4044
                                                                                                                                                      • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                        6⤵
                                                                                                                                                          PID:1656
                                                                                                                                                        • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                          6⤵
                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                          PID:3208
                                                                                                                                                          • C:\Program Files (x86)\Google\Update\1.3.36.71\update.exe
                                                                                                                                                            "C:\Program Files (x86)\Google\Update\1.3.36.71\update.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                            7⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            PID:1584
                                                                                                                                                          • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                            7⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            PID:2360
                                                                                                                                                            • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                              8⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:5104
                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                        5⤵
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        PID:1096
                                                                                                                                                        • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                          6⤵
                                                                                                                                                          • System policy modification
                                                                                                                                                          PID:692
                                                                                                                                                        • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                          6⤵
                                                                                                                                                            PID:3496
                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\images\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                                                            6⤵
                                                                                                                                                              PID:936
                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                              6⤵
                                                                                                                                                                PID:2432
                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\es-ES\update.exe
                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\es-ES\update.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:5116
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                                                                5⤵
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                PID:444
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\update.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\update.exe" C:\Program Files (x86)\Microsoft\Edge\
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  PID:1340
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
                                                                                                                                                                    7⤵
                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:212
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:3592
                                                                                                                                                              • C:\Users\backup.exe
                                                                                                                                                                C:\Users\backup.exe C:\Users\
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1844
                                                                                                                                                                  • C:\Users\Admin\backup.exe
                                                                                                                                                                    C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    PID:4968
                                                                                                                                                                    • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                      "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      • System policy modification
                                                                                                                                                                      PID:924
                                                                                                                                                                    • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                      C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:4408
                                                                                                                                                                      • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:768
                                                                                                                                                                        • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                          C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          PID:1420
                                                                                                                                                                        • C:\Users\Admin\Downloads\System Restore.exe
                                                                                                                                                                          "C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:3628
                                                                                                                                                                          • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                            C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:1228
                                                                                                                                                                            • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                              C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:4616
                                                                                                                                                                              • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                PID:4008
                                                                                                                                                                              • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                                C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                6⤵
                                                                                                                                                                                • System policy modification
                                                                                                                                                                                PID:1544
                                                                                                                                                                              • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:4064
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:540
                                                                                                                                                                                    • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                                      "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:3456
                                                                                                                                                                                  • C:\Users\Public\backup.exe
                                                                                                                                                                                    C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:1740
                                                                                                                                                                                      • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        PID:4716
                                                                                                                                                                                      • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        PID:1408
                                                                                                                                                                                      • C:\Users\Public\Music\data.exe
                                                                                                                                                                                        C:\Users\Public\Music\data.exe C:\Users\Public\Music\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:2320
                                                                                                                                                                                        • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                          C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          PID:2540
                                                                                                                                                                                        • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                          C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5004
                                                                                                                                                                                      • C:\Windows\backup.exe
                                                                                                                                                                                        C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:4124
                                                                                                                                                                                        • C:\Windows\addins\backup.exe
                                                                                                                                                                                          C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:1576
                                                                                                                                                                                          • C:\Windows\appcompat\backup.exe
                                                                                                                                                                                            C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:3980
                                                                                                                                                                                            • C:\Windows\appcompat\appraiser\System Restore.exe
                                                                                                                                                                                              "C:\Windows\appcompat\appraiser\System Restore.exe" C:\Windows\appcompat\appraiser\
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:2088
                                                                                                                                                                                              • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                                C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:3500
                                                                                                                                                                                              • C:\Windows\appcompat\encapsulation\data.exe
                                                                                                                                                                                                C:\Windows\appcompat\encapsulation\data.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                PID:5088
                                                                                                                                                                                              • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                              • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                                C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:4916
                                                                                                                                                                                                • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                                                                                  C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                  PID:4236
                                                                                                                                                                                                • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                                                                                  C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:392
                                                                                                                                                                                                  • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                                                                                    C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:4256
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\update.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\acrocef_low\update.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:2264
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:4800
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:4560
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:4204
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:4736
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:5004
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3384
                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3428
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4840
                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4008

                                                                                                                                                                                                Network

                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                Downloads

                                                                                                                                                                                                • C:\PerfLogs\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  81c50d7b2deb1a29a0823b5af269db92

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8a68ba975baceb4294532563ceeb2fa3a96c19fe

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  bf81d844137517bf02e7056bb2ecde16ece47643e1bf5b3808ba42cd6297ecaa

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d211bfa8c174bbebf4017cb85bf75a02d46ee909df71ec65ffe689d09ebfb1b679fa040c895303bbf6ea61c359ecfbce47c43d34c1ec650704ea83a6adc87f75

                                                                                                                                                                                                • C:\PerfLogs\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  81c50d7b2deb1a29a0823b5af269db92

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8a68ba975baceb4294532563ceeb2fa3a96c19fe

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  bf81d844137517bf02e7056bb2ecde16ece47643e1bf5b3808ba42cd6297ecaa

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d211bfa8c174bbebf4017cb85bf75a02d46ee909df71ec65ffe689d09ebfb1b679fa040c895303bbf6ea61c359ecfbce47c43d34c1ec650704ea83a6adc87f75

                                                                                                                                                                                                • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  8defe56b114f50b78afbf980f9a255f0

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ad5d77c57dfbdc18610286da036dc4edf0f99c60

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  49300850878c246a1585f435c25e2415e3ab36104694e275c262d07ed4cada97

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f1ad415f0410b275e2b36f00be2f583a843e8e2a67d7dbb2fa95389ebd60689dc88be2a67d1c24ea00d656fed8c91927f3d3d8da91c4a1c5d2815a515057e24a

                                                                                                                                                                                                • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  8defe56b114f50b78afbf980f9a255f0

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ad5d77c57dfbdc18610286da036dc4edf0f99c60

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  49300850878c246a1585f435c25e2415e3ab36104694e275c262d07ed4cada97

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f1ad415f0410b275e2b36f00be2f583a843e8e2a67d7dbb2fa95389ebd60689dc88be2a67d1c24ea00d656fed8c91927f3d3d8da91c4a1c5d2815a515057e24a

                                                                                                                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c11278c35facfc01c528a045a6208e6c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b7bcaa6b434bfef67186da5c95f5e5584c4d260a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  7acedb1bd21902453eb16e61b5d0383f761aa9bafd6984ab48675f0f2803dc01

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  072504739c71c859ccea923ae792a40030c0928063d3c80cb45f97d6c8865cdcf98594078ba250687498603e942f0e31356eabe12141281f977978152bba03d8

                                                                                                                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c11278c35facfc01c528a045a6208e6c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b7bcaa6b434bfef67186da5c95f5e5584c4d260a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  7acedb1bd21902453eb16e61b5d0383f761aa9bafd6984ab48675f0f2803dc01

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  072504739c71c859ccea923ae792a40030c0928063d3c80cb45f97d6c8865cdcf98594078ba250687498603e942f0e31356eabe12141281f977978152bba03d8

                                                                                                                                                                                                • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  b94d251cacf8dced01b2eb9458457b55

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ee76af51ba52e302d83361357a6ebe4df909ecea

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  d9c84d42b64d249779ae60d31d2e0f3fa3add4d9c6f4965bb8e011cc7e6b1fe2

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f779fa5b9d9a1fea6047bcc3c0ab9d1eb0e4a8d759f33fa7d8cb4819de04ee9f8e1b4b95720e1f5c42af28325777f2d1835430b778316771301b79409e8444b0

                                                                                                                                                                                                • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  b94d251cacf8dced01b2eb9458457b55

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ee76af51ba52e302d83361357a6ebe4df909ecea

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  d9c84d42b64d249779ae60d31d2e0f3fa3add4d9c6f4965bb8e011cc7e6b1fe2

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f779fa5b9d9a1fea6047bcc3c0ab9d1eb0e4a8d759f33fa7d8cb4819de04ee9f8e1b4b95720e1f5c42af28325777f2d1835430b778316771301b79409e8444b0

                                                                                                                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  06c8254ea210954deb681509209a0ef4

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  c6985e6475189f504829a7e570cbba468b9e3481

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  b909c2a7d51d0da1a006c791796466a1a851197989aba2d1fd54ce8dd092c3c7

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0ffc81f6f504527ef9999af121f46a01329702b27b195510f4e5e92fb6dc15ba66cbece5c9823eac146d052c85694a8697caef7f499b5809c987af036f6fcadd

                                                                                                                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  06c8254ea210954deb681509209a0ef4

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  c6985e6475189f504829a7e570cbba468b9e3481

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  b909c2a7d51d0da1a006c791796466a1a851197989aba2d1fd54ce8dd092c3c7

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0ffc81f6f504527ef9999af121f46a01329702b27b195510f4e5e92fb6dc15ba66cbece5c9823eac146d052c85694a8697caef7f499b5809c987af036f6fcadd

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  51e074868cb90a682d0d6277213144a2

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  78cc02792b5bc0da803edea3d44b553cc69c14ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  54d1bd8eb65f1503d151769fbfd2688e8583fee62a7264659771554484590d3e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  8463b79d7e26bcb61f51debbb110912d8983d1a0d941edff26b84add6a76d0b9ba3cb4b7b68a93d166dc64c01de1730c2de01d9f62593f5a231b781f1587a73f

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  51e074868cb90a682d0d6277213144a2

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  78cc02792b5bc0da803edea3d44b553cc69c14ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  54d1bd8eb65f1503d151769fbfd2688e8583fee62a7264659771554484590d3e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  8463b79d7e26bcb61f51debbb110912d8983d1a0d941edff26b84add6a76d0b9ba3cb4b7b68a93d166dc64c01de1730c2de01d9f62593f5a231b781f1587a73f

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e5bba2209ede57bfd4d8eb0a5448ddc5

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  04b4b1022258740a2aca26e1a13765bc614c926b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  41937ece22e9c992014dcec0a8db8f975cb2ee87e9a4693d5d8577fe251f9c9e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  fd923bb7a55e4ea3036244c4cb9ee6ca8fc1ec4c50e5a704b4415f06a9593c6d64cb29bf882282a9098e525295112614107fdd43e50c5fdeac8822495b710674

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e5bba2209ede57bfd4d8eb0a5448ddc5

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  04b4b1022258740a2aca26e1a13765bc614c926b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  41937ece22e9c992014dcec0a8db8f975cb2ee87e9a4693d5d8577fe251f9c9e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  fd923bb7a55e4ea3036244c4cb9ee6ca8fc1ec4c50e5a704b4415f06a9593c6d64cb29bf882282a9098e525295112614107fdd43e50c5fdeac8822495b710674

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\data.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  6c80fd1fa6c9530be2294c976119037c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  19bc246209a460f54dfae5457ec08c6d437335bf

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  602c43681986b9810b62663c4f57a5bcc6e53daf7872ecfe076b9497a2512692

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  6dc94d2d219b1e8c7688ee2444b6287537204e148022c98b16ebec43f6d64c60892421823ad4ecfe1afc71fba3b80e109e9146795c8dfb804096d9a9d40491ec

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\data.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  6c80fd1fa6c9530be2294c976119037c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  19bc246209a460f54dfae5457ec08c6d437335bf

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  602c43681986b9810b62663c4f57a5bcc6e53daf7872ecfe076b9497a2512692

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  6dc94d2d219b1e8c7688ee2444b6287537204e148022c98b16ebec43f6d64c60892421823ad4ecfe1afc71fba3b80e109e9146795c8dfb804096d9a9d40491ec

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  51e074868cb90a682d0d6277213144a2

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  78cc02792b5bc0da803edea3d44b553cc69c14ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  54d1bd8eb65f1503d151769fbfd2688e8583fee62a7264659771554484590d3e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  8463b79d7e26bcb61f51debbb110912d8983d1a0d941edff26b84add6a76d0b9ba3cb4b7b68a93d166dc64c01de1730c2de01d9f62593f5a231b781f1587a73f

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  51e074868cb90a682d0d6277213144a2

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  78cc02792b5bc0da803edea3d44b553cc69c14ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  54d1bd8eb65f1503d151769fbfd2688e8583fee62a7264659771554484590d3e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  8463b79d7e26bcb61f51debbb110912d8983d1a0d941edff26b84add6a76d0b9ba3cb4b7b68a93d166dc64c01de1730c2de01d9f62593f5a231b781f1587a73f

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  956ae58370af0bb13f0d2b540e3813a6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d02125307323989ea172ab557a0aae10577f8c39

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e7a07e31453ec24064be247e37785c1ffe339eb8373f181379575ea709f30054

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  aa2f63cd047f1b147749b04fd56ecf18e6980f4aac74fa83eafe06aa3cc1e072c5bb45e913bc4d0a6aa1237eb455081db1311a6e629323143b424b98337695f8

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  956ae58370af0bb13f0d2b540e3813a6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d02125307323989ea172ab557a0aae10577f8c39

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e7a07e31453ec24064be247e37785c1ffe339eb8373f181379575ea709f30054

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  aa2f63cd047f1b147749b04fd56ecf18e6980f4aac74fa83eafe06aa3cc1e072c5bb45e913bc4d0a6aa1237eb455081db1311a6e629323143b424b98337695f8

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  956ae58370af0bb13f0d2b540e3813a6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d02125307323989ea172ab557a0aae10577f8c39

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e7a07e31453ec24064be247e37785c1ffe339eb8373f181379575ea709f30054

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  aa2f63cd047f1b147749b04fd56ecf18e6980f4aac74fa83eafe06aa3cc1e072c5bb45e913bc4d0a6aa1237eb455081db1311a6e629323143b424b98337695f8

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  956ae58370af0bb13f0d2b540e3813a6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d02125307323989ea172ab557a0aae10577f8c39

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e7a07e31453ec24064be247e37785c1ffe339eb8373f181379575ea709f30054

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  aa2f63cd047f1b147749b04fd56ecf18e6980f4aac74fa83eafe06aa3cc1e072c5bb45e913bc4d0a6aa1237eb455081db1311a6e629323143b424b98337695f8

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  956ae58370af0bb13f0d2b540e3813a6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d02125307323989ea172ab557a0aae10577f8c39

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e7a07e31453ec24064be247e37785c1ffe339eb8373f181379575ea709f30054

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  aa2f63cd047f1b147749b04fd56ecf18e6980f4aac74fa83eafe06aa3cc1e072c5bb45e913bc4d0a6aa1237eb455081db1311a6e629323143b424b98337695f8

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  956ae58370af0bb13f0d2b540e3813a6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d02125307323989ea172ab557a0aae10577f8c39

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e7a07e31453ec24064be247e37785c1ffe339eb8373f181379575ea709f30054

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  aa2f63cd047f1b147749b04fd56ecf18e6980f4aac74fa83eafe06aa3cc1e072c5bb45e913bc4d0a6aa1237eb455081db1311a6e629323143b424b98337695f8

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c77f5efb4401ea23c6121c037920d94e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bc54cb1251608826bd9e92e50333710fe7e5ef93

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0021d962c80b327c258a99e5c2dde773334274d516c100d7e36efcef3d4d846f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce33f68e8c34aefc5866b6cb6fa8e20e0ef726b0053835dd4ba3d6f0eeb8c4e550f2f89f979ddce9ddb6568a6968799508c496c10a4be59e688227f409734338

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23340d1aa57f1e9d9166ad4166daf245

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  80240d4abb5e0cd08fdd2bf39a677bf91cc813ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  107a6efcb544fecd823dc82ae917b5bfc3fe854553157407fa834b5e467eec49

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  13171dacbec06ecb16d9272e4d473651340b1cb0f1e03d23249e3afb585c22aa4496550ad07c3dfdd8ac45dc8736bccb79f39420f6e96b275b60be0262f24c0d

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23340d1aa57f1e9d9166ad4166daf245

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  80240d4abb5e0cd08fdd2bf39a677bf91cc813ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  107a6efcb544fecd823dc82ae917b5bfc3fe854553157407fa834b5e467eec49

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  13171dacbec06ecb16d9272e4d473651340b1cb0f1e03d23249e3afb585c22aa4496550ad07c3dfdd8ac45dc8736bccb79f39420f6e96b275b60be0262f24c0d

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23340d1aa57f1e9d9166ad4166daf245

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  80240d4abb5e0cd08fdd2bf39a677bf91cc813ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  107a6efcb544fecd823dc82ae917b5bfc3fe854553157407fa834b5e467eec49

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  13171dacbec06ecb16d9272e4d473651340b1cb0f1e03d23249e3afb585c22aa4496550ad07c3dfdd8ac45dc8736bccb79f39420f6e96b275b60be0262f24c0d

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23340d1aa57f1e9d9166ad4166daf245

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  80240d4abb5e0cd08fdd2bf39a677bf91cc813ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  107a6efcb544fecd823dc82ae917b5bfc3fe854553157407fa834b5e467eec49

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  13171dacbec06ecb16d9272e4d473651340b1cb0f1e03d23249e3afb585c22aa4496550ad07c3dfdd8ac45dc8736bccb79f39420f6e96b275b60be0262f24c0d

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23340d1aa57f1e9d9166ad4166daf245

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  80240d4abb5e0cd08fdd2bf39a677bf91cc813ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  107a6efcb544fecd823dc82ae917b5bfc3fe854553157407fa834b5e467eec49

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  13171dacbec06ecb16d9272e4d473651340b1cb0f1e03d23249e3afb585c22aa4496550ad07c3dfdd8ac45dc8736bccb79f39420f6e96b275b60be0262f24c0d

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23340d1aa57f1e9d9166ad4166daf245

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  80240d4abb5e0cd08fdd2bf39a677bf91cc813ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  107a6efcb544fecd823dc82ae917b5bfc3fe854553157407fa834b5e467eec49

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  13171dacbec06ecb16d9272e4d473651340b1cb0f1e03d23249e3afb585c22aa4496550ad07c3dfdd8ac45dc8736bccb79f39420f6e96b275b60be0262f24c0d

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23340d1aa57f1e9d9166ad4166daf245

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  80240d4abb5e0cd08fdd2bf39a677bf91cc813ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  107a6efcb544fecd823dc82ae917b5bfc3fe854553157407fa834b5e467eec49

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  13171dacbec06ecb16d9272e4d473651340b1cb0f1e03d23249e3afb585c22aa4496550ad07c3dfdd8ac45dc8736bccb79f39420f6e96b275b60be0262f24c0d

                                                                                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23340d1aa57f1e9d9166ad4166daf245

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  80240d4abb5e0cd08fdd2bf39a677bf91cc813ae

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  107a6efcb544fecd823dc82ae917b5bfc3fe854553157407fa834b5e467eec49

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  13171dacbec06ecb16d9272e4d473651340b1cb0f1e03d23249e3afb585c22aa4496550ad07c3dfdd8ac45dc8736bccb79f39420f6e96b275b60be0262f24c0d

                                                                                                                                                                                                • C:\Program Files\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  81c50d7b2deb1a29a0823b5af269db92

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8a68ba975baceb4294532563ceeb2fa3a96c19fe

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  bf81d844137517bf02e7056bb2ecde16ece47643e1bf5b3808ba42cd6297ecaa

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d211bfa8c174bbebf4017cb85bf75a02d46ee909df71ec65ffe689d09ebfb1b679fa040c895303bbf6ea61c359ecfbce47c43d34c1ec650704ea83a6adc87f75

                                                                                                                                                                                                • C:\Program Files\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  81c50d7b2deb1a29a0823b5af269db92

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8a68ba975baceb4294532563ceeb2fa3a96c19fe

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  bf81d844137517bf02e7056bb2ecde16ece47643e1bf5b3808ba42cd6297ecaa

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d211bfa8c174bbebf4017cb85bf75a02d46ee909df71ec65ffe689d09ebfb1b679fa040c895303bbf6ea61c359ecfbce47c43d34c1ec650704ea83a6adc87f75

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\976864069\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23e3ef5329eaeeb0f9eaec78b325d37e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  7430562f106d4ba13c81e60f7e535679c48d8a05

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  64aecab1b7e72262fddd2624fea33cc7a02182037a27b7ff7c89623156f747fa

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  dfcca8bd90489027d37a4e8c0c03a3fd28094f254006087958947047de377d4c2aabcf49c7d2681d338211a17a29d0774d1a985bb2feb21dec4bc514cf976fa0

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\976864069\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  23e3ef5329eaeeb0f9eaec78b325d37e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  7430562f106d4ba13c81e60f7e535679c48d8a05

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  64aecab1b7e72262fddd2624fea33cc7a02182037a27b7ff7c89623156f747fa

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  dfcca8bd90489027d37a4e8c0c03a3fd28094f254006087958947047de377d4c2aabcf49c7d2681d338211a17a29d0774d1a985bb2feb21dec4bc514cf976fa0

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  640b7d6d18a7262e974ab0f64f221026

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  49be78a53617b1f50ec83fc343567e6c50f3b0f1

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  33d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  640b7d6d18a7262e974ab0f64f221026

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  49be78a53617b1f50ec83fc343567e6c50f3b0f1

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  33d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c616123db82ccb7f67454ca40e88323c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  965c7a498eb4a2424f4a32a550ff36b5e306e218

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  074591fe3f86a735e112c41370b83ffe6c3a646336ae989df30325ce8a75b5ee

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  007293b1dab1cf3e3dbaf33529b640d771869b785180050e08c0ee50fd0499296d931542aa353e72bc0d820a1953e57c0c0dec43954f2d043fa25c84dab1b560

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c616123db82ccb7f67454ca40e88323c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  965c7a498eb4a2424f4a32a550ff36b5e306e218

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  074591fe3f86a735e112c41370b83ffe6c3a646336ae989df30325ce8a75b5ee

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  007293b1dab1cf3e3dbaf33529b640d771869b785180050e08c0ee50fd0499296d931542aa353e72bc0d820a1953e57c0c0dec43954f2d043fa25c84dab1b560

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c616123db82ccb7f67454ca40e88323c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  965c7a498eb4a2424f4a32a550ff36b5e306e218

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  074591fe3f86a735e112c41370b83ffe6c3a646336ae989df30325ce8a75b5ee

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  007293b1dab1cf3e3dbaf33529b640d771869b785180050e08c0ee50fd0499296d931542aa353e72bc0d820a1953e57c0c0dec43954f2d043fa25c84dab1b560

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c616123db82ccb7f67454ca40e88323c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  965c7a498eb4a2424f4a32a550ff36b5e306e218

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  074591fe3f86a735e112c41370b83ffe6c3a646336ae989df30325ce8a75b5ee

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  007293b1dab1cf3e3dbaf33529b640d771869b785180050e08c0ee50fd0499296d931542aa353e72bc0d820a1953e57c0c0dec43954f2d043fa25c84dab1b560

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\update.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  778644173f1c62eee30660bde8d79534

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\update.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  778644173f1c62eee30660bde8d79534

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  640b7d6d18a7262e974ab0f64f221026

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  49be78a53617b1f50ec83fc343567e6c50f3b0f1

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  33d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  640b7d6d18a7262e974ab0f64f221026

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  49be78a53617b1f50ec83fc343567e6c50f3b0f1

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  33d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  2c231ee13260bf3ab886ef4ea38ae73c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  c8373736b77172aade148b84e1e9f7ece1305a3c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  a46d4e7994da4a41f687a32a6c4fded0df2d226c1496a2af99ae860b1bd812df

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e18bfee3d7d05bf3a379d05f9cb992ff7ff69ca9da00109e0cb98bc73f9c04a604d38948754ef1f199d59f0f9df2bcc7c512490d2fe370c04b8fca18b818b2d5

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  2c231ee13260bf3ab886ef4ea38ae73c

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  c8373736b77172aade148b84e1e9f7ece1305a3c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  a46d4e7994da4a41f687a32a6c4fded0df2d226c1496a2af99ae860b1bd812df

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e18bfee3d7d05bf3a379d05f9cb992ff7ff69ca9da00109e0cb98bc73f9c04a604d38948754ef1f199d59f0f9df2bcc7c512490d2fe370c04b8fca18b818b2d5

                                                                                                                                                                                                • C:\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  2bf25cd4eea37f844610457d48e8fc56

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  45bad04d9fa51e63105bdff43b5431e5789bd3c1

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  08c448deb1c3fb2af644ab5df7c2cf743a826d7375765593e6d59cbe1d716886

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  9340eb630bd3875d1d61d1cf0bde3a70b9277b6a5a0c4ca6340b92fe8500f4a582cb0e72779ac577ffe40a09f675844aa5372a380f176627dd6260f5920a54d3

                                                                                                                                                                                                • C:\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  2bf25cd4eea37f844610457d48e8fc56

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  45bad04d9fa51e63105bdff43b5431e5789bd3c1

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  08c448deb1c3fb2af644ab5df7c2cf743a826d7375765593e6d59cbe1d716886

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  9340eb630bd3875d1d61d1cf0bde3a70b9277b6a5a0c4ca6340b92fe8500f4a582cb0e72779ac577ffe40a09f675844aa5372a380f176627dd6260f5920a54d3

                                                                                                                                                                                                • C:\odt\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  3ebf5f4365b636aea6184ad5d2de26cf

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  07f416520742bafc1fbe8780216ce7f5e443fa0f

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  df833b372182769ee1d163055e653c9fa061a872ebeaac63f8da83c0eec9d600

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ad7d47d594f271f60c608d3b68075b44e32b831615b1e94a253d4c150d0e4702bcde81314b9eebcf34ae6ce23e8431691632e56ecbd6c628eabc10481a8ccccc

                                                                                                                                                                                                • C:\odt\backup.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  3ebf5f4365b636aea6184ad5d2de26cf

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  07f416520742bafc1fbe8780216ce7f5e443fa0f

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  df833b372182769ee1d163055e653c9fa061a872ebeaac63f8da83c0eec9d600

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ad7d47d594f271f60c608d3b68075b44e32b831615b1e94a253d4c150d0e4702bcde81314b9eebcf34ae6ce23e8431691632e56ecbd6c628eabc10481a8ccccc