Analysis

  • max time kernel
    190s
  • max time network
    217s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 17:39

General

  • Target

    7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe

  • Size

    72KB

  • MD5

    009b50173931a42e43ef40bb34477026

  • SHA1

    6817fd238d171b32b172e7bbf8908a99cfcba2df

  • SHA256

    7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d

  • SHA512

    a66ce1274cea06d9d64d9597e5c2e3b78b50a9e99a25d4fe1c3b603ff4ff9a9081576794abdf4759c84a059b1a06cc1056ed92506d967a2192db3fbc3517aedb

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2b:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr3

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe
    "C:\Users\Admin\AppData\Local\Temp\7c7fadab85e5f15421aa75a5f4b8661ce96cbf9657c17f3212c5e11dbf457d1d.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Users\Admin\AppData\Local\Temp\1941823504\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1941823504\backup.exe C:\Users\Admin\AppData\Local\Temp\1941823504\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1468
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1568
          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
            5⤵
              PID:4256
              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                6⤵
                  PID:4696
                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                    7⤵
                      PID:1780
                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                        8⤵
                          PID:4092
                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                          8⤵
                            PID:2028
                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                              9⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:4248
                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                          7⤵
                          • Disables RegEdit via registry modification
                          PID:2548
                  • C:\PerfLogs\System Restore.exe
                    "C:\PerfLogs\System Restore.exe" C:\PerfLogs\
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4416
                  • C:\Program Files\data.exe
                    "C:\Program Files\data.exe" C:\Program Files\
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4300
                    • C:\Program Files\7-Zip\backup.exe
                      "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:240
                      • C:\Program Files\7-Zip\Lang\data.exe
                        "C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:564
                    • C:\Program Files\Common Files\backup.exe
                      "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:404
                      • C:\Program Files\Common Files\DESIGNER\update.exe
                        "C:\Program Files\Common Files\DESIGNER\update.exe" C:\Program Files\Common Files\DESIGNER\
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4664
                      • C:\Program Files\Common Files\microsoft shared\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
                        6⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2072
                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:4256
                        • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                          7⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:3908
                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                            8⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:2368
                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:3548
                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1896
                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1056
                          • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2532
                          • C:\Program Files\Common Files\microsoft shared\ink\el-GR\update.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\el-GR\update.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:4288
                          • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1700
                          • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1184
                          • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:4132
                          • C:\Program Files\Common Files\microsoft shared\ink\es-MX\data.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\es-MX\data.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2852
                          • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:3000
                          • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1864
                          • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                            8⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1400
                          • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:3312
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                            8⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            PID:4364
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                              9⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:2024
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                              9⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4652
                              • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                10⤵
                                  PID:4276
                              • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                                9⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:4992
                              • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                                9⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1288
                              • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                                9⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:2548
                              • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                                9⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4124
                              • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                                9⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1692
                                • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe
                                  "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\
                                  10⤵
                                    PID:2692
                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe
                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\
                                    10⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:1288
                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe
                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\
                                    10⤵
                                    • Drops file in Program Files directory
                                    PID:4808
                                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                                  9⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2632
                                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                                  9⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4808
                                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                                  9⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3084
                              • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2144
                              • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                                8⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:4984
                              • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2812
                              • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1624
                              • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:2032
                              • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2920
                              • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                                8⤵
                                  PID:4076
                                • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                                  8⤵
                                    PID:5036
                                  • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                                    8⤵
                                      PID:1976
                                    • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                                      8⤵
                                      • System policy modification
                                      PID:852
                                    • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:3036
                                    • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:5028
                                    • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:736
                                    • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                                      8⤵
                                        PID:4224
                                      • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:3512
                                      • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                                        8⤵
                                          PID:5044
                                        • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                                          8⤵
                                            PID:60
                                          • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\data.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                                            8⤵
                                              PID:4992
                                            • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                                              8⤵
                                                PID:1232
                                              • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                                                8⤵
                                                • System policy modification
                                                PID:1136
                                              • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                                                8⤵
                                                  PID:4256
                                                • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                                                  8⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • System policy modification
                                                  PID:2532
                                                • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                                                  8⤵
                                                    PID:4204
                                                  • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                                                    8⤵
                                                      PID:2992
                                                    • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                                                      8⤵
                                                        PID:4360
                                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\System Restore.exe
                                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:5116
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                                        8⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        PID:2224
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                                        8⤵
                                                          PID:4100
                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          PID:1700
                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\update.exe
                                                          "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          PID:4808
                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          PID:4188
                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                                          8⤵
                                                          • System policy modification
                                                          PID:4056
                                                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                                        7⤵
                                                          PID:2944
                                                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                                            8⤵
                                                            • Disables RegEdit via registry modification
                                                            • System policy modification
                                                            PID:4784
                                                        • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                                          7⤵
                                                            PID:1140
                                                          • C:\Program Files\Common Files\microsoft shared\Source Engine\data.exe
                                                            "C:\Program Files\Common Files\microsoft shared\Source Engine\data.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                                            7⤵
                                                              PID:2524
                                                            • C:\Program Files\Common Files\microsoft shared\Stationery\System Restore.exe
                                                              "C:\Program Files\Common Files\microsoft shared\Stationery\System Restore.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                                              7⤵
                                                                PID:1376
                                                              • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                                                "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                                                7⤵
                                                                • Drops file in Program Files directory
                                                                PID:4652
                                                              • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                                                "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                                                7⤵
                                                                  PID:1628
                                                                  • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                                                    "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                                    8⤵
                                                                    • Disables RegEdit via registry modification
                                                                    PID:2572
                                                                • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                                                  "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                                                  7⤵
                                                                    PID:3968
                                                                  • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                                                    "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                                                    7⤵
                                                                      PID:4888
                                                                    • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                                                      "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                                                      7⤵
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:856
                                                                  • C:\Program Files\Common Files\Services\backup.exe
                                                                    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                                    6⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:3208
                                                                  • C:\Program Files\Common Files\System\backup.exe
                                                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2400
                                                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                                      7⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1472
                                                                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                                        8⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        PID:3708
                                                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                                        8⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:4664
                                                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                                        8⤵
                                                                          PID:4036
                                                                        • C:\Program Files\Common Files\System\ado\fr-FR\data.exe
                                                                          "C:\Program Files\Common Files\System\ado\fr-FR\data.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:2020
                                                                        • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                                          "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • System policy modification
                                                                          PID:3748
                                                                        • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                                          "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          PID:4052
                                                                      • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                                        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                                        7⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:4612
                                                                      • C:\Program Files\Common Files\System\en-US\backup.exe
                                                                        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                                        7⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:4796
                                                                      • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                                        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                                        7⤵
                                                                          PID:4224
                                                                        • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                                          "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                          7⤵
                                                                            PID:4752
                                                                          • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                            "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                            7⤵
                                                                              PID:1424
                                                                            • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                              "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                              7⤵
                                                                              • System policy modification
                                                                              PID:3632
                                                                            • C:\Program Files\Common Files\System\msadc\backup.exe
                                                                              "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                                              7⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Drops file in Program Files directory
                                                                              PID:5112
                                                                              • C:\Program Files\Common Files\System\msadc\de-DE\System Restore.exe
                                                                                "C:\Program Files\Common Files\System\msadc\de-DE\System Restore.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                                8⤵
                                                                                  PID:2708
                                                                                • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                                  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                                  8⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  • System policy modification
                                                                                  PID:2368
                                                                                • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                                  "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                                  8⤵
                                                                                  • System policy modification
                                                                                  PID:612
                                                                                • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                                  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                                  8⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  • System policy modification
                                                                                  PID:2040
                                                                                • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                                  "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                                  8⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  • System policy modification
                                                                                  PID:2308
                                                                                • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                                  "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                                  8⤵
                                                                                    PID:4316
                                                                                • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                                  "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                                  7⤵
                                                                                    PID:1972
                                                                                    • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                                      "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                                      8⤵
                                                                                        PID:1360
                                                                                      • C:\Program Files\Common Files\System\Ole DB\fr-FR\System Restore.exe
                                                                                        "C:\Program Files\Common Files\System\Ole DB\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                                        8⤵
                                                                                          PID:1124
                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe
                                                                                            "C:\Program Files (x86)\Mozilla Maintenance Service\logs\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\logs\
                                                                                            9⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            • System policy modification
                                                                                            PID:4620
                                                                                        • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                                          "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                                          8⤵
                                                                                            PID:4232
                                                                                          • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                                            "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                                            8⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:5004
                                                                                          • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                                            "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                                            8⤵
                                                                                            • Drops file in Windows directory
                                                                                            PID:2220
                                                                                          • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                                            "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                                            8⤵
                                                                                              PID:2992
                                                                                      • C:\Program Files\Google\backup.exe
                                                                                        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Program Files directory
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:2092
                                                                                        • C:\Program Files\Google\Chrome\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:444
                                                                                          • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                                            7⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:4164
                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                              8⤵
                                                                                              • Drops file in Program Files directory
                                                                                              PID:2760
                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                                9⤵
                                                                                                  PID:4256
                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                                  9⤵
                                                                                                  • System policy modification
                                                                                                  PID:1056
                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                                  9⤵
                                                                                                    PID:1560
                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                                    9⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    PID:2188
                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                                    9⤵
                                                                                                      PID:3736
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                                      9⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:4460
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                                      9⤵
                                                                                                        PID:3692
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\update.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                                        9⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        PID:3452
                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                                          10⤵
                                                                                                            PID:2748
                                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                              11⤵
                                                                                                                PID:4892
                                                                                                        • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                                          8⤵
                                                                                                            PID:4808
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
                                                                                                              9⤵
                                                                                                                PID:3928
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\
                                                                                                                9⤵
                                                                                                                  PID:1036
                                                                                                              • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                                                                                8⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                PID:3008
                                                                                                                • C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
                                                                                                                  9⤵
                                                                                                                    PID:4200
                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\backup.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
                                                                                                                    9⤵
                                                                                                                      PID:4864
                                                                                                                  • C:\Program Files\Mozilla Firefox\defaults\backup.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
                                                                                                                    8⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:2200
                                                                                                                    • C:\Program Files\Mozilla Firefox\defaults\pref\System Restore.exe
                                                                                                                      "C:\Program Files\Mozilla Firefox\defaults\pref\System Restore.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
                                                                                                                      9⤵
                                                                                                                        PID:1756
                                                                                                                    • C:\Program Files\Mozilla Firefox\fonts\backup.exe
                                                                                                                      "C:\Program Files\Mozilla Firefox\fonts\backup.exe" C:\Program Files\Mozilla Firefox\fonts\
                                                                                                                      8⤵
                                                                                                                        PID:2988
                                                                                                                • C:\Program Files\Internet Explorer\backup.exe
                                                                                                                  "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                                                  5⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:3232
                                                                                                                  • C:\Program Files\Internet Explorer\de-DE\data.exe
                                                                                                                    "C:\Program Files\Internet Explorer\de-DE\data.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                                                    6⤵
                                                                                                                      PID:2260
                                                                                                                    • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                                                      "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                                                      6⤵
                                                                                                                        PID:3528
                                                                                                                      • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                                                        "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                                                        6⤵
                                                                                                                          PID:1864
                                                                                                                        • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                                                          "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                                                          6⤵
                                                                                                                            PID:2200
                                                                                                                          • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                                                            "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                                                            6⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • System policy modification
                                                                                                                            PID:3440
                                                                                                                          • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                                                            "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                                                            6⤵
                                                                                                                              PID:4868
                                                                                                                            • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                                                              "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                                                              6⤵
                                                                                                                                PID:2508
                                                                                                                              • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                                                                "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                                                                6⤵
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                PID:4656
                                                                                                                            • C:\Program Files\Java\backup.exe
                                                                                                                              "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                                                              5⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:2472
                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\data.exe
                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\data.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                                                                6⤵
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                PID:2132
                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                                                                  7⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  PID:4484
                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\update.exe
                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\update.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                                                                  7⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • System policy modification
                                                                                                                                  PID:2816
                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                                                    8⤵
                                                                                                                                      PID:3704
                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                                                                    7⤵
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    PID:1816
                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                                                      8⤵
                                                                                                                                        PID:8
                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                                                          9⤵
                                                                                                                                            PID:4536
                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                                                        7⤵
                                                                                                                                          PID:1920
                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                                                            8⤵
                                                                                                                                            • System policy modification
                                                                                                                                            PID:3212
                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe
                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                                                                              9⤵
                                                                                                                                              • System policy modification
                                                                                                                                              PID:3340
                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                                                                              9⤵
                                                                                                                                                PID:2960
                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                                                                              8⤵
                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              PID:1880
                                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe
                                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\
                                                                                                                                                9⤵
                                                                                                                                                  PID:1288
                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
                                                                                                                                                    10⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    PID:852
                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\System Restore.exe
                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
                                                                                                                                                    10⤵
                                                                                                                                                      PID:4656
                                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\update.exe
                                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\update.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
                                                                                                                                                      10⤵
                                                                                                                                                        PID:4532
                                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe
                                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\
                                                                                                                                                      9⤵
                                                                                                                                                        PID:4296
                                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\backup.exe
                                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\
                                                                                                                                                        9⤵
                                                                                                                                                          PID:1384
                                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\backup.exe
                                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\
                                                                                                                                                          9⤵
                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                          PID:60
                                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\data.exe
                                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\data.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\
                                                                                                                                                          9⤵
                                                                                                                                                            PID:4500
                                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe
                                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\
                                                                                                                                                            9⤵
                                                                                                                                                              PID:2208
                                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\backup.exe
                                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\
                                                                                                                                                              9⤵
                                                                                                                                                                PID:3312
                                                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe
                                                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:548
                                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\lib\update.exe
                                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\lib\update.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                                                                                                              7⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:3276
                                                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe
                                                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\
                                                                                                                                                                8⤵
                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                PID:1692
                                                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                                                                            6⤵
                                                                                                                                                              PID:3868
                                                                                                                                                              • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                                                                                                "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                                                                                7⤵
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:3568
                                                                                                                                                                • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:5044
                                                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:2212
                                                                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:1072
                                                                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\lib\backup.exe
                                                                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\lib\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:4024
                                                                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\lib\amd64\update.exe
                                                                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\lib\amd64\update.exe" C:\Program Files\Java\jre1.8.0_66\lib\amd64\
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:1424
                                                                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe
                                                                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\cmm\
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:4392
                                                                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe
                                                                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\applet\
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:4484
                                                                                                                                                                        • C:\Program Files\Microsoft Office\update.exe
                                                                                                                                                                          "C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          PID:4728
                                                                                                                                                                          • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                                                                                            "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                                                                            6⤵
                                                                                                                                                                            • System policy modification
                                                                                                                                                                            PID:3704
                                                                                                                                                                          • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                                                                                            "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:976
                                                                                                                                                                            • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                                                                                                              "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                              PID:1032
                                                                                                                                                                              • C:\Program Files\Microsoft Office\root\Integration\backup.exe
                                                                                                                                                                                "C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:4712
                                                                                                                                                                                • C:\Program Files\Microsoft Office\root\fre\backup.exe
                                                                                                                                                                                  "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:1836
                                                                                                                                                                                  • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                                                                                                    "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    PID:2404
                                                                                                                                                                                  • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                                                                                                                    "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:4500
                                                                                                                                                                                • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                                                                                                  "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:2764
                                                                                                                                                                                    • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                                                                                                                                      "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:4324
                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                      PID:4164
                                                                                                                                                                                  • C:\Program Files (x86)\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                    PID:3144
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                      PID:3700
                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:1352
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:1088
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                          PID:964
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                            PID:4288
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                                                                              9⤵
                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                              PID:3592
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            PID:2632
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\System Restore.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                                                                              9⤵
                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                              PID:1488
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                                                                            8⤵
                                                                                                                                                                                              PID:404
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:1584
                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                  PID:3204
                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:3708
                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:1552
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                      PID:4720
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:612
                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                          PID:1292
                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            PID:3972
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                PID:3468
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                              PID:2272
                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          PID:2816
                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:800
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:3576
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                PID:3540
                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:2612
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:2964
                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:740
                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                PID:208
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\data.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\data.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\data.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\data.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:1108
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\update.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\update.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                        PID:1052
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      PID:3896
                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\data.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\data.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                        PID:2032
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                      PID:1568
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:2032
                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Java\Java Update\data.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Java\Java Update\data.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                        PID:1728
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:5072
                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                          PID:1236
                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          PID:2516
                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:1976
                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:4868
                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:1944
                                                                                                                                                                                                                            • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:3084
                                                                                                                                                                                                                                • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                    PID:4396
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                        PID:1896
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\data.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                PID:1292
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\Install\{9FE34FF4-CC04-4D7E-96B4-2FFAA3FF5050}\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\Install\{9FE34FF4-CC04-4D7E-96B4-2FFAA3FF5050}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{9FE34FF4-CC04-4D7E-96B4-2FFAA3FF5050}\
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\Offline\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                            PID:1424
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:2492
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                              PID:1312
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:2368
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\es-ES\data.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\es-ES\data.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                PID:2088
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                PID:4040
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\images\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                PID:208
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:4780
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:1140
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:2408
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                      PID:4732
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft.NET\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                    PID:2580
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft.NET\RedistList\backup.exe" C:\Program Files (x86)\Microsoft.NET\RedistList\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                      PID:748
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backup.exe" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                      PID:4992
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\MSBuild\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\MSBuild\backup.exe" C:\Program Files (x86)\MSBuild\
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:4056
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Mozilla Maintenance Service\data.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Mozilla Maintenance Service\data.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      PID:1124
                                                                                                                                                                                                                                                  • C:\Users\backup.exe
                                                                                                                                                                                                                                                    C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:2376
                                                                                                                                                                                                                                                    • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      PID:3584
                                                                                                                                                                                                                                                      • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:1392
                                                                                                                                                                                                                                                        • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:3204
                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:1608
                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                PID:3208
                                                                                                                                                                                                                                                              • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:1956
                                                                                                                                                                                                                                                                • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:1540
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                  • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                    PID:4060
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:3120
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                        PID:3552
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Saved Games\update.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Saved Games\update.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                      PID:1696
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Videos\update.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\Videos\update.exe C:\Users\Admin\Videos\
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                        PID:2692
                                                                                                                                                                                                                                                                    • C:\Users\Public\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                        PID:112
                                                                                                                                                                                                                                                                      • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                                                                        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                        PID:3512
                                                                                                                                                                                                                                                                      • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                                                                                        C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:1756
                                                                                                                                                                                                                                                                        • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                                                          C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:8
                                                                                                                                                                                                                                                                          • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                                        • C:\Windows\backup.exe
                                                                                                                                                                                                                                                                          C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                          PID:944
                                                                                                                                                                                                                                                                          • C:\Windows\addins\backup.exe
                                                                                                                                                                                                                                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                                                          • C:\Windows\appcompat\backup.exe
                                                                                                                                                                                                                                                                            C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:1608
                                                                                                                                                                                                                                                                            • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                                                                                                              C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                                                                                              • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                                                                                                C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:1264
                                                                                                                                                                                                                                                                                • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                                                                                                  C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                  PID:2852
                                                                                                                                                                                                                                                                              • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                                                                                                                C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:3896
                                                                                                                                                                                                                                                                                • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                                                                                                                                                                                  C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                  PID:1356
                                                                                                                                                                                                                                                                                • C:\Windows\apppatch\it-IT\backup.exe
                                                                                                                                                                                                                                                                                  C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                  • C:\Windows\apppatch\es-ES\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:4348
                                                                                                                                                                                                                                                                                    • C:\Windows\apppatch\en-US\backup.exe
                                                                                                                                                                                                                                                                                      C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:3732
                                                                                                                                                                                                                                                                                      • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                                                                                                                                                                                        C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\Custom\update.exe
                                                                                                                                                                                                                                                                                          C:\Windows\apppatch\Custom\update.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:1804
                                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                                                                                                                                                                          C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                          PID:4752
                                                                                                                                                                                                                                                                                      • C:\Windows\AppReadiness\backup.exe
                                                                                                                                                                                                                                                                                        C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:3600
                                                                                                                                                                                                                                                                                        • C:\Windows\assembly\backup.exe
                                                                                                                                                                                                                                                                                          C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:4956
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    PID:1972
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    PID:3704
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\data.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Low\data.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    PID:1088
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                    PID:1396
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                    PID:1628
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    PID:1236
                                                                                                                                                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:828
                                                                                                                                                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:2632
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                      PID:4820
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                        PID:2768
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                          PID:432
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                            PID:2116
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                            PID:1088
                                                                                                                                                                                                                                                                                            • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                                                                                                                              C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                              PID:4024
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                          PID:968
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:4188
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                            PID:1836
                                                                                                                                                                                                                                                                                      • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                                                                                                                                                                        C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:4844
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                        PID:2632
                                                                                                                                                                                                                                                                                      • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:1728
                                                                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:3000
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                            PID:2168
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                              PID:2900
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:64
                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                              PID:4044
                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                PID:4700
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                              PID:2796
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                PID:3488
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1052
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:4744
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                                                                                  • C:\Windows\assembly\GAC\ADODB\backup.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:3508
                                                                                                                                                                                                                                                                                                    • C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:1404
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:1140
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                        PID:4088
                                                                                                                                                                                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\backup.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:5096
                                                                                                                                                                                                                                                                                                        • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                                            PID:3956
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:4616
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\data.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                              PID:4928
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                              PID:3880

                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                            • C:\PerfLogs\System Restore.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              77e5fe2c4706de877c3dfa5573605af7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1d1ad965c6b752c4bcd748077f00f9e23252f827

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              28b88051bb7e5934b853d02ee3c6ac755b4ca4b043678610da4f5e2e66c0bd2c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              23fb29cb25adcc94566bd833589c542ab77e98ad3efc64b7d9b2e4169a1bb1b9cc3e4c9fb3e83d8b3beefd26a5b3f807f53d946fa5274f3055b69e72b75d7958

                                                                                                                                                                                                                                                                                                            • C:\PerfLogs\System Restore.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              77e5fe2c4706de877c3dfa5573605af7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1d1ad965c6b752c4bcd748077f00f9e23252f827

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              28b88051bb7e5934b853d02ee3c6ac755b4ca4b043678610da4f5e2e66c0bd2c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              23fb29cb25adcc94566bd833589c542ab77e98ad3efc64b7d9b2e4169a1bb1b9cc3e4c9fb3e83d8b3beefd26a5b3f807f53d946fa5274f3055b69e72b75d7958

                                                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\Lang\data.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ae94d15d4a3751e02cfa354c96055d95

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9bdf79ff0646d571a8ca1f735ba956c62d7836a0

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ffcb5ded6245292c44a6698c8ccb763098187875c0d46c304b0a801dc7fcc35b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3e588953afe8fadfc0cf092074d6b2ada9f6c27bb6010482533564fce8be4cb7ba7c7624466433d1516f229d1026fd9b2af37f0386b1d1fee29a3383e789e1b9

                                                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\Lang\data.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ae94d15d4a3751e02cfa354c96055d95

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9bdf79ff0646d571a8ca1f735ba956c62d7836a0

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ffcb5ded6245292c44a6698c8ccb763098187875c0d46c304b0a801dc7fcc35b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3e588953afe8fadfc0cf092074d6b2ada9f6c27bb6010482533564fce8be4cb7ba7c7624466433d1516f229d1026fd9b2af37f0386b1d1fee29a3383e789e1b9

                                                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              4ffacce723af4207b7476b66c843ba5c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b2bf7c95ccbf6062323ea06cb5cec7937361219d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              c73e99131a4944a16f3e7c42edff68df686b5b1938ee6aab16f2116c8cb52d1d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              16eae28f20c22fc4550141939b116f946152482fd4c191662255d18637ea9f65543344e414defe502df6da1be98a738899dace1eb3da0e309ab9c769a6d92829

                                                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              4ffacce723af4207b7476b66c843ba5c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b2bf7c95ccbf6062323ea06cb5cec7937361219d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              c73e99131a4944a16f3e7c42edff68df686b5b1938ee6aab16f2116c8cb52d1d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              16eae28f20c22fc4550141939b116f946152482fd4c191662255d18637ea9f65543344e414defe502df6da1be98a738899dace1eb3da0e309ab9c769a6d92829

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\DESIGNER\update.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              fe3673ddd5a358363cb0cd93761b15e1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d589bba0341c471d9635ee7804bbdab64354afee

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2d23655efd5559f46907a984ec2da2b95a550272433f2736c0477eb77185a74b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8aeb1ab4ea7f12774f901bb2be56f6ac535c0fd83bc01596f9b50d68569f747c60f6066908aed780f63ddf2177acc0ad6f257b6e8b869cd69b5a64a8803c970f

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\DESIGNER\update.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              fe3673ddd5a358363cb0cd93761b15e1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d589bba0341c471d9635ee7804bbdab64354afee

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2d23655efd5559f46907a984ec2da2b95a550272433f2736c0477eb77185a74b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8aeb1ab4ea7f12774f901bb2be56f6ac535c0fd83bc01596f9b50d68569f747c60f6066908aed780f63ddf2177acc0ad6f257b6e8b869cd69b5a64a8803c970f

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              94a434f00ee53ed2dfd1dc80b77a6f14

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              606e19f02c1291d12e98ac420f3c43d5ceb791bf

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              55995d242fccd15fe3cf704bfcec5497b6693873dedb81556f0b32046a2b86cd

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0ba60d97f72362b9cbf39ab9356466ec9d9731d928fb6abeec98ab215f564ddec26384ca2c77cee9cd393cf91c7ac11837eff07dffe071c864b0178213e06f27

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              94a434f00ee53ed2dfd1dc80b77a6f14

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              606e19f02c1291d12e98ac420f3c43d5ceb791bf

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              55995d242fccd15fe3cf704bfcec5497b6693873dedb81556f0b32046a2b86cd

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0ba60d97f72362b9cbf39ab9356466ec9d9731d928fb6abeec98ab215f564ddec26384ca2c77cee9cd393cf91c7ac11837eff07dffe071c864b0178213e06f27

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              1f55ce3420d907304c40869b574cc116

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3c2dd528a7910fa77c820eb100c8d37704f3a523

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              9fa77645b8a0714107a747234c1f58ad0d8c3214746ac30fe5a1bf04e1d7fa82

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ac0643f7de955cb819f786b779986846795409c9ee29b90b71f0fba9d9aefca161c7d5e5c4e16ddf202feb3e7681882d6b971b62c0a58cc494b68350b329d0a0

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              1f55ce3420d907304c40869b574cc116

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3c2dd528a7910fa77c820eb100c8d37704f3a523

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              9fa77645b8a0714107a747234c1f58ad0d8c3214746ac30fe5a1bf04e1d7fa82

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ac0643f7de955cb819f786b779986846795409c9ee29b90b71f0fba9d9aefca161c7d5e5c4e16ddf202feb3e7681882d6b971b62c0a58cc494b68350b329d0a0

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              fe3673ddd5a358363cb0cd93761b15e1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d589bba0341c471d9635ee7804bbdab64354afee

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2d23655efd5559f46907a984ec2da2b95a550272433f2736c0477eb77185a74b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8aeb1ab4ea7f12774f901bb2be56f6ac535c0fd83bc01596f9b50d68569f747c60f6066908aed780f63ddf2177acc0ad6f257b6e8b869cd69b5a64a8803c970f

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              fe3673ddd5a358363cb0cd93761b15e1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d589bba0341c471d9635ee7804bbdab64354afee

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2d23655efd5559f46907a984ec2da2b95a550272433f2736c0477eb77185a74b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8aeb1ab4ea7f12774f901bb2be56f6ac535c0fd83bc01596f9b50d68569f747c60f6066908aed780f63ddf2177acc0ad6f257b6e8b869cd69b5a64a8803c970f

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8ed31925fb31bf4d0af444575721d50e

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ce95f98f28374e08ea80bccca0614993b1ef2f1d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d4b5b0b33d6acc9cb2c95ad7881d71d25d957493337b1d60dfe08f317424df85

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a9b87b5bbf2e23f79cb6b788061ab6a2331232cd2a07b419d677f08d4c7e0fdd29baa7566d81060e080cf0d69a0c3bf581b7d91397e4b641ed7c0d75224d43c6

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8ed31925fb31bf4d0af444575721d50e

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ce95f98f28374e08ea80bccca0614993b1ef2f1d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d4b5b0b33d6acc9cb2c95ad7881d71d25d957493337b1d60dfe08f317424df85

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a9b87b5bbf2e23f79cb6b788061ab6a2331232cd2a07b419d677f08d4c7e0fdd29baa7566d81060e080cf0d69a0c3bf581b7d91397e4b641ed7c0d75224d43c6

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\el-GR\update.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\el-GR\update.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              eba8566f12c145bde2f5514830f7da31

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ccc2ba86fd2836523d3419f28d0ffdffb8ed7929

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              30506209bfb798b4a597d919b7dd6d080505fe3e32b9f478c185c9bea8f097d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aedc5844b827f72765c75a559226979d4d5b9d632bcef533674cf97f5a13b1917a267e62bf11b8830d753aec867b9e4b54d61ebe74c706b51bb933f026cec588

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\es-MX\data.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\es-MX\data.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d1cfb9ff876eaaaf0214e8633cc5dce2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8b06d408cfe61070a9314e6e09f81adce402eb5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3d1eebb75d2ee7a2809b3e09f5c7aea047e5d381f3f6491ddff6e672fc960b4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7023bd3ca4f5d99d312462fab32296a0da506b4c55b69c41e2bf6ea2ecc7e2c96c1c0a40b1128d005d2b526a49d4f8b2bddb79a81f82f3ef6a5eec8856befb6a

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3d284c1661789cf31784f709af4aac7a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3d826d4de9b06f4c63c4786b4c5bbb1051e32463

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8b5362c8f61318066ac9dc9a24ddb7ce644416171bbb676c9b5bf1f9a8306b38

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              fbace0d5ba151b989ba8cda599fae0e917d73e2146655cd7e38b211b2ed571580911965f9d98d69f1aad3a54f9aa6b3f3e20d10bf27eced4c888205c13cb49d8

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3d284c1661789cf31784f709af4aac7a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3d826d4de9b06f4c63c4786b4c5bbb1051e32463

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8b5362c8f61318066ac9dc9a24ddb7ce644416171bbb676c9b5bf1f9a8306b38

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              fbace0d5ba151b989ba8cda599fae0e917d73e2146655cd7e38b211b2ed571580911965f9d98d69f1aad3a54f9aa6b3f3e20d10bf27eced4c888205c13cb49d8

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3d284c1661789cf31784f709af4aac7a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3d826d4de9b06f4c63c4786b4c5bbb1051e32463

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8b5362c8f61318066ac9dc9a24ddb7ce644416171bbb676c9b5bf1f9a8306b38

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              fbace0d5ba151b989ba8cda599fae0e917d73e2146655cd7e38b211b2ed571580911965f9d98d69f1aad3a54f9aa6b3f3e20d10bf27eced4c888205c13cb49d8

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3d284c1661789cf31784f709af4aac7a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3d826d4de9b06f4c63c4786b4c5bbb1051e32463

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8b5362c8f61318066ac9dc9a24ddb7ce644416171bbb676c9b5bf1f9a8306b38

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              fbace0d5ba151b989ba8cda599fae0e917d73e2146655cd7e38b211b2ed571580911965f9d98d69f1aad3a54f9aa6b3f3e20d10bf27eced4c888205c13cb49d8

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3d284c1661789cf31784f709af4aac7a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3d826d4de9b06f4c63c4786b4c5bbb1051e32463

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8b5362c8f61318066ac9dc9a24ddb7ce644416171bbb676c9b5bf1f9a8306b38

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              fbace0d5ba151b989ba8cda599fae0e917d73e2146655cd7e38b211b2ed571580911965f9d98d69f1aad3a54f9aa6b3f3e20d10bf27eced4c888205c13cb49d8

                                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3d284c1661789cf31784f709af4aac7a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3d826d4de9b06f4c63c4786b4c5bbb1051e32463

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8b5362c8f61318066ac9dc9a24ddb7ce644416171bbb676c9b5bf1f9a8306b38

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              fbace0d5ba151b989ba8cda599fae0e917d73e2146655cd7e38b211b2ed571580911965f9d98d69f1aad3a54f9aa6b3f3e20d10bf27eced4c888205c13cb49d8

                                                                                                                                                                                                                                                                                                            • C:\Program Files\data.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              77e5fe2c4706de877c3dfa5573605af7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1d1ad965c6b752c4bcd748077f00f9e23252f827

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              28b88051bb7e5934b853d02ee3c6ac755b4ca4b043678610da4f5e2e66c0bd2c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              23fb29cb25adcc94566bd833589c542ab77e98ad3efc64b7d9b2e4169a1bb1b9cc3e4c9fb3e83d8b3beefd26a5b3f807f53d946fa5274f3055b69e72b75d7958

                                                                                                                                                                                                                                                                                                            • C:\Program Files\data.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              77e5fe2c4706de877c3dfa5573605af7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1d1ad965c6b752c4bcd748077f00f9e23252f827

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              28b88051bb7e5934b853d02ee3c6ac755b4ca4b043678610da4f5e2e66c0bd2c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              23fb29cb25adcc94566bd833589c542ab77e98ad3efc64b7d9b2e4169a1bb1b9cc3e4c9fb3e83d8b3beefd26a5b3f807f53d946fa5274f3055b69e72b75d7958

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1941823504\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              93b9ee584f6134bfd99e21814b44ff96

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9429c096c8cb613c74d2d6bf2a6f6998e5a116d2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              14499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1941823504\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              93b9ee584f6134bfd99e21814b44ff96

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9429c096c8cb613c74d2d6bf2a6f6998e5a116d2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              14499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\data.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              93b9ee584f6134bfd99e21814b44ff96

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9429c096c8cb613c74d2d6bf2a6f6998e5a116d2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              14499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\data.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              93b9ee584f6134bfd99e21814b44ff96

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9429c096c8cb613c74d2d6bf2a6f6998e5a116d2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              14499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9a31c970b472b810c94aad6c8d0955c7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1301858010b33e6c4afa9be5d05182bccc48f49e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              461486521c7b578e6144f9b35061bb48509bf0c198f40c4e6ce65f5db442edc2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9cfe53ab2a8a5d85eb3c27ac4fc6478c8263e9169fdbb27b32e8fa7001c916f0cb674e6cb429ebf313baec7d63d77a928b3d759f88c40db07a9f42003295ea18

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9a31c970b472b810c94aad6c8d0955c7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1301858010b33e6c4afa9be5d05182bccc48f49e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              461486521c7b578e6144f9b35061bb48509bf0c198f40c4e6ce65f5db442edc2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9cfe53ab2a8a5d85eb3c27ac4fc6478c8263e9169fdbb27b32e8fa7001c916f0cb674e6cb429ebf313baec7d63d77a928b3d759f88c40db07a9f42003295ea18

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9a31c970b472b810c94aad6c8d0955c7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1301858010b33e6c4afa9be5d05182bccc48f49e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              461486521c7b578e6144f9b35061bb48509bf0c198f40c4e6ce65f5db442edc2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9cfe53ab2a8a5d85eb3c27ac4fc6478c8263e9169fdbb27b32e8fa7001c916f0cb674e6cb429ebf313baec7d63d77a928b3d759f88c40db07a9f42003295ea18

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9a31c970b472b810c94aad6c8d0955c7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1301858010b33e6c4afa9be5d05182bccc48f49e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              461486521c7b578e6144f9b35061bb48509bf0c198f40c4e6ce65f5db442edc2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9cfe53ab2a8a5d85eb3c27ac4fc6478c8263e9169fdbb27b32e8fa7001c916f0cb674e6cb429ebf313baec7d63d77a928b3d759f88c40db07a9f42003295ea18

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              93b9ee584f6134bfd99e21814b44ff96

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9429c096c8cb613c74d2d6bf2a6f6998e5a116d2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              14499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              93b9ee584f6134bfd99e21814b44ff96

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9429c096c8cb613c74d2d6bf2a6f6998e5a116d2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              14499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              93b9ee584f6134bfd99e21814b44ff96

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9429c096c8cb613c74d2d6bf2a6f6998e5a116d2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              14499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              93b9ee584f6134bfd99e21814b44ff96

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9429c096c8cb613c74d2d6bf2a6f6998e5a116d2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              296746e7f8a54c9f7a3630bedc02fb374abbaf3224411632ccc582fffc8db296

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              14499ff15d51d76c028f1580a31910260ceaa3899fd26301f99939a8d152c00520d9281867f4515fc96d1c9ac37313b7a436a96fc71187a03ea259afbd4360c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9a31c970b472b810c94aad6c8d0955c7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1301858010b33e6c4afa9be5d05182bccc48f49e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              461486521c7b578e6144f9b35061bb48509bf0c198f40c4e6ce65f5db442edc2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9cfe53ab2a8a5d85eb3c27ac4fc6478c8263e9169fdbb27b32e8fa7001c916f0cb674e6cb429ebf313baec7d63d77a928b3d759f88c40db07a9f42003295ea18

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9a31c970b472b810c94aad6c8d0955c7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1301858010b33e6c4afa9be5d05182bccc48f49e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              461486521c7b578e6144f9b35061bb48509bf0c198f40c4e6ce65f5db442edc2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9cfe53ab2a8a5d85eb3c27ac4fc6478c8263e9169fdbb27b32e8fa7001c916f0cb674e6cb429ebf313baec7d63d77a928b3d759f88c40db07a9f42003295ea18

                                                                                                                                                                                                                                                                                                            • C:\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2e8acedb3a37d09ae45d878adef9e016

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5efb988fca1839953e8c1dce5f021e9bf106a7c1

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              1d0e4acb53586e0fd74f395461cd2fe748c5721bba4699d45fb8e930070b8673

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              5788f2abab4aacfed610c1cf976d03e4039652071b06fafca5cf14b52c3109f928db940379a058d98235dcac7fdf1c5a5267053d1373124474fdbd022c2ac654

                                                                                                                                                                                                                                                                                                            • C:\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2e8acedb3a37d09ae45d878adef9e016

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5efb988fca1839953e8c1dce5f021e9bf106a7c1

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              1d0e4acb53586e0fd74f395461cd2fe748c5721bba4699d45fb8e930070b8673

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              5788f2abab4aacfed610c1cf976d03e4039652071b06fafca5cf14b52c3109f928db940379a058d98235dcac7fdf1c5a5267053d1373124474fdbd022c2ac654

                                                                                                                                                                                                                                                                                                            • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9599160dcd53297554442d1d6600502b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1b9e7b90ab16a4d26cc15beead586adbdbdef256

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              322bced269d2177d83e6707e418321a8539bec7251e5d378f30a2c8c90d05e78

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aa6725525c8077593dadd76144ce3709aacd387ce4fe81018e4199608d4a2d0058b5c5d67a3920e2c34cb6a13c63e0d1cccf8c3b7ba7af2bff6b3769b72207be

                                                                                                                                                                                                                                                                                                            • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9599160dcd53297554442d1d6600502b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1b9e7b90ab16a4d26cc15beead586adbdbdef256

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              322bced269d2177d83e6707e418321a8539bec7251e5d378f30a2c8c90d05e78

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aa6725525c8077593dadd76144ce3709aacd387ce4fe81018e4199608d4a2d0058b5c5d67a3920e2c34cb6a13c63e0d1cccf8c3b7ba7af2bff6b3769b72207be