Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    238s
  • max time network
    231s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 17:43

General

  • Target

    61c5b1b48239237204987174db48b5a5656f6287366ce3b1a0683f6a4f7385d7.exe

  • Size

    72KB

  • MD5

    0333e63079d9f6649379128ef5a4af7d

  • SHA1

    46d62d115a4aac9f943b956c242edb1339c1f17a

  • SHA256

    61c5b1b48239237204987174db48b5a5656f6287366ce3b1a0683f6a4f7385d7

  • SHA512

    26b5cc999cb2b2173cd881e0f86ae0e4ae1cad8b8feef3c667fa8f72b203cb060d786b7b596c9066bbd2ce9d807ecc5e60521b7ae25724775002afd29537c9af

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2B:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrd

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61c5b1b48239237204987174db48b5a5656f6287366ce3b1a0683f6a4f7385d7.exe
    "C:\Users\Admin\AppData\Local\Temp\61c5b1b48239237204987174db48b5a5656f6287366ce3b1a0683f6a4f7385d7.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Users\Admin\AppData\Local\Temp\3028667159\update.exe
      C:\Users\Admin\AppData\Local\Temp\3028667159\update.exe C:\Users\Admin\AppData\Local\Temp\3028667159\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:404
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2132
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1980
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4928
        • C:\Program Files\update.exe
          "C:\Program Files\update.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4764
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3088
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4208
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1588
            • C:\Program Files\Common Files\DESIGNER\System Restore.exe
              "C:\Program Files\Common Files\DESIGNER\System Restore.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:512
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3800
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:5000
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4120
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2004
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4308
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4944
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2652
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2124
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4472
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3224
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2180
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4504
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2328
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4452
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4700
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1032
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1128
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2516
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3456
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:664
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4744
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5116
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1404
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                      PID:3168
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\System Restore.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                      9⤵
                        PID:1600
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                        9⤵
                          PID:3116
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                          9⤵
                          • Disables RegEdit via registry modification
                          PID:5104
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                          9⤵
                            PID:2052
                        • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                          8⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:2128
                          • C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\backup.exe
                            "C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\
                            9⤵
                              PID:4596
                          • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                            8⤵
                            • System policy modification
                            PID:1136
                          • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                            8⤵
                            • System policy modification
                            PID:4196
                          • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                            8⤵
                            • System policy modification
                            PID:4424
                          • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:4392
                          • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\data.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\data.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                            8⤵
                              PID:2656
                            • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                              8⤵
                                PID:260
                              • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                                8⤵
                                  PID:3424
                                • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                                  8⤵
                                  • System policy modification
                                  PID:1848
                                • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:2696
                                • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                                  8⤵
                                    PID:3788
                                  • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                                    8⤵
                                      PID:3364
                                    • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                                      8⤵
                                        PID:5080
                                      • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:3592
                                      • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\data.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\data.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                                        8⤵
                                        • System policy modification
                                        PID:1080
                                      • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                                        8⤵
                                          PID:1248
                                        • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                                          8⤵
                                            PID:624
                                          • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                                            8⤵
                                              PID:2992
                                            • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                                              8⤵
                                                PID:3576
                                              • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                                                8⤵
                                                  PID:1516
                                                • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                                                  8⤵
                                                    PID:4840
                                                  • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                                                    8⤵
                                                      PID:4872
                                                    • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                                                      8⤵
                                                        PID:1692
                                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3132
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                                        8⤵
                                                        • Disables RegEdit via registry modification
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4368
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3204
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        • System policy modification
                                                        PID:3956
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                                        8⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1844
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3948
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • System policy modification
                                                        PID:3768
                                                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                                      7⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:4996
                                                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                                        8⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • System policy modification
                                                        PID:1500
                                                    • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                                      7⤵
                                                        PID:2504
                                                      • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                                        7⤵
                                                          PID:2448
                                                        • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                                          7⤵
                                                            PID:3440
                                                          • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Drops file in Program Files directory
                                                            PID:3464
                                                            • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\data.exe
                                                              "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:2900
                                                          • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            PID:3796
                                                            • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                              8⤵
                                                              • System policy modification
                                                              PID:1644
                                                          • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                                            7⤵
                                                              PID:3536
                                                            • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                                              7⤵
                                                              • Disables RegEdit via registry modification
                                                              PID:2628
                                                            • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                                              7⤵
                                                              • System policy modification
                                                              PID:2180
                                                              • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                                "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                                8⤵
                                                                • System policy modification
                                                                PID:3600
                                                          • C:\Program Files\Common Files\Services\backup.exe
                                                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2884
                                                          • C:\Program Files\Common Files\System\backup.exe
                                                            "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                            6⤵
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4328
                                                            • C:\Program Files\Common Files\System\ado\backup.exe
                                                              "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                              7⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:4272
                                                              • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                                "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                                8⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:4624
                                                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                                "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:4212
                                                              • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                                "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                                8⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:260
                                                              • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                                "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                                8⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3836
                                                              • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                                "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                PID:4616
                                                              • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                                "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                                8⤵
                                                                  PID:3788
                                                              • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                                "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                                7⤵
                                                                  PID:908
                                                                • C:\Program Files\Common Files\System\en-US\backup.exe
                                                                  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                                  7⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:2396
                                                                • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                                  "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                                  7⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  PID:1716
                                                                • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                                  "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                  7⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:2292
                                                                • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                  "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                  7⤵
                                                                    PID:3928
                                                                  • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                    "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                    7⤵
                                                                      PID:2792
                                                                    • C:\Program Files\Common Files\System\msadc\backup.exe
                                                                      "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                                      7⤵
                                                                        PID:3652
                                                                        • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                                          "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                          8⤵
                                                                            PID:2600
                                                                          • C:\Program Files\Common Files\System\msadc\en-US\data.exe
                                                                            "C:\Program Files\Common Files\System\msadc\en-US\data.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System policy modification
                                                                            PID:4872
                                                                          • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                            "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:380
                                                                          • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                            "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                            8⤵
                                                                              PID:4220
                                                                            • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                              "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              PID:2324
                                                                            • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                              "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                              8⤵
                                                                                PID:3604
                                                                            • C:\Program Files\Common Files\System\Ole DB\System Restore.exe
                                                                              "C:\Program Files\Common Files\System\Ole DB\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                              7⤵
                                                                              • Drops file in Program Files directory
                                                                              PID:5100
                                                                              • C:\Program Files\Common Files\System\Ole DB\de-DE\update.exe
                                                                                "C:\Program Files\Common Files\System\Ole DB\de-DE\update.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                PID:4720
                                                                              • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                                "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                                8⤵
                                                                                • System policy modification
                                                                                PID:3528
                                                                              • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                                "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                                8⤵
                                                                                • Disables RegEdit via registry modification
                                                                                PID:208
                                                                              • C:\Program Files\Common Files\System\Ole DB\it-IT\data.exe
                                                                                "C:\Program Files\Common Files\System\Ole DB\it-IT\data.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                                8⤵
                                                                                • System policy modification
                                                                                PID:4392
                                                                              • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                                "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                                8⤵
                                                                                  PID:2112
                                                                                • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                                  "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                                  8⤵
                                                                                    PID:3120
                                                                            • C:\Program Files\Google\backup.exe
                                                                              "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                              5⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1764
                                                                              • C:\Program Files\Google\Chrome\backup.exe
                                                                                "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                                6⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1488
                                                                                • C:\Program Files\Google\Chrome\Application\update.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\update.exe" C:\Program Files\Google\Chrome\Application\
                                                                                  7⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4540
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                    8⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Program Files directory
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2440
                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                      9⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:4152
                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                      9⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:4028
                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                      9⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3624
                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                      9⤵
                                                                                      • System policy modification
                                                                                      PID:2000
                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                      9⤵
                                                                                        PID:4512
                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                        9⤵
                                                                                          PID:3380
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                          9⤵
                                                                                            PID:4912
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                              10⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              PID:1432
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                              10⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              PID:2980
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                11⤵
                                                                                                  PID:1456
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                  11⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  PID:3480
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                    12⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    PID:4268
                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
                                                                                                      13⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:4280
                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
                                                                                                        14⤵
                                                                                                          PID:1048
                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                                9⤵
                                                                                                  PID:2492
                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\System Restore.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                                    10⤵
                                                                                                      PID:4128
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                        11⤵
                                                                                                          PID:1252
                                                                                                  • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                                    8⤵
                                                                                                    • System policy modification
                                                                                                    PID:1704
                                                                                            • C:\Program Files\Internet Explorer\backup.exe
                                                                                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                              5⤵
                                                                                              • Drops file in Program Files directory
                                                                                              PID:1896
                                                                                              • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                                "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                                6⤵
                                                                                                  PID:4248
                                                                                                • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                                  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                                  6⤵
                                                                                                    PID:4888
                                                                                                  • C:\Program Files\Internet Explorer\es-ES\update.exe
                                                                                                    "C:\Program Files\Internet Explorer\es-ES\update.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:2400
                                                                                                  • C:\Program Files\Internet Explorer\fr-FR\data.exe
                                                                                                    "C:\Program Files\Internet Explorer\fr-FR\data.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                                    6⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    PID:664
                                                                                                  • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                                    "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                                    6⤵
                                                                                                      PID:640
                                                                                                    • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                                      "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                                      6⤵
                                                                                                      • System policy modification
                                                                                                      PID:1892
                                                                                                    • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                                      "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                                      6⤵
                                                                                                        PID:5104
                                                                                                      • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                                        "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                                        6⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        PID:652
                                                                                                    • C:\Program Files\Java\backup.exe
                                                                                                      "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                                      5⤵
                                                                                                      • System policy modification
                                                                                                      PID:2360
                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                                        6⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:2880
                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                                          7⤵
                                                                                                            PID:2972
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                                            7⤵
                                                                                                            • Drops file in Program Files directory
                                                                                                            • System policy modification
                                                                                                            PID:2516
                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                              8⤵
                                                                                                                PID:3576
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                                                8⤵
                                                                                                                  PID:2400
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                                                7⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:3536
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                                  8⤵
                                                                                                                    PID:4140
                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                                      9⤵
                                                                                                                        PID:4484
                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                                    7⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:5024
                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                                      8⤵
                                                                                                                        PID:3604
                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                                          9⤵
                                                                                                                            PID:664
                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\System Restore.exe
                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                                                            9⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            PID:1828
                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                                                            9⤵
                                                                                                                              PID:1844
                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                                                            8⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            PID:220
                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe
                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\
                                                                                                                              9⤵
                                                                                                                                PID:4596
                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe
                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\
                                                                                                                                9⤵
                                                                                                                                  PID:2628
                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe
                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\
                                                                                                                                  9⤵
                                                                                                                                    PID:2792
                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe
                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                                                                                7⤵
                                                                                                                                  PID:4392
                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe
                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\
                                                                                                                                    8⤵
                                                                                                                                      PID:2548
                                                                                                                                • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                                                  6⤵
                                                                                                                                    PID:3924
                                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                                                      7⤵
                                                                                                                                        PID:4208
                                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                                          8⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          PID:3932
                                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                                          8⤵
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          PID:4600
                                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                                          8⤵
                                                                                                                                            PID:4380
                                                                                                                                    • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                                      "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                                      5⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      PID:3160
                                                                                                                                      • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                                                        "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                                        6⤵
                                                                                                                                          PID:4028
                                                                                                                                        • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                                                          "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                                          6⤵
                                                                                                                                            PID:2440
                                                                                                                                          • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                                                                            "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                                            6⤵
                                                                                                                                              PID:3648
                                                                                                                                        • C:\Program Files (x86)\backup.exe
                                                                                                                                          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                                          4⤵
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:1672
                                                                                                                                          • C:\Program Files (x86)\Adobe\update.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\
                                                                                                                                            5⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:4292
                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:1108
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                                                7⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:4116
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                                                7⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                • System policy modification
                                                                                                                                                PID:724
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                                  8⤵
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:5012
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                                    9⤵
                                                                                                                                                      PID:4500
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                                    8⤵
                                                                                                                                                      PID:3404
                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                                        9⤵
                                                                                                                                                          PID:4620
                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                                        8⤵
                                                                                                                                                          PID:4472
                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                                          8⤵
                                                                                                                                                          • System policy modification
                                                                                                                                                          PID:4648
                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                                          8⤵
                                                                                                                                                            PID:3492
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\data.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                                              9⤵
                                                                                                                                                                PID:3184
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                                              8⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:3204
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\update.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                                                9⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:1356
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                                              8⤵
                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                              PID:952
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                                              8⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              PID:2320
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:1632
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\System Restore.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:1032
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:2704
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                                                  8⤵
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  • System policy modification
                                                                                                                                                                  PID:3236
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:5092
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                                                        10⤵
                                                                                                                                                                          PID:1448
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\data.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:736
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:440
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:4620
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                                                                            8⤵
                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                            PID:836
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\data.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                                                                            8⤵
                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                            PID:3944
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:4224
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                            PID:4916
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:5032
                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                                                  9⤵
                                                                                                                                                                                    PID:1388
                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:4352
                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  PID:4580
                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\System Restore.exe
                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                                                7⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                PID:4668
                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:4092
                                                                                                                                                                            • C:\Program Files (x86)\Common Files\System Restore.exe
                                                                                                                                                                              "C:\Program Files (x86)\Common Files\System Restore.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              PID:820
                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                • System policy modification
                                                                                                                                                                                PID:4368
                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  PID:3636
                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:864
                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                                                      8⤵
                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                      PID:4208
                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:1492
                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:444
                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:2780
                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        PID:4320
                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:2008
                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        PID:1580
                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          PID:4540
                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:1392
                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
                                                                                                                                                                                            8⤵
                                                                                                                                                                                              PID:3868
                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:1692
                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                  PID:3364
                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:2856
                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:1384
                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:5072
                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      PID:4820
                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:2236
                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:4968
                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                    • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                      • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                        PID:1600
                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                        PID:2284
                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          PID:544
                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:1408
                                                                                                                                                                                                            • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:5044
                                                                                                                                                                                                                • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:2548
                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\System Restore.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\System Restore.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\data.exe
                                                                                                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\data.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
                                                                                                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                            PID:3272
                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                      PID:2128
                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Update\Offline\update.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Update\Offline\update.exe" C:\Program Files (x86)\Google\Update\Offline\
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                      PID:4240
                                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  PID:1896
                                                                                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                    PID:3644
                                                                                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:1668
                                                                                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:4688
                                                                                                                                                                                                                        • C:\Program Files (x86)\Internet Explorer\images\backup.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:664
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:4212
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                              PID:4896
                                                                                                                                                                                                                        • C:\Users\backup.exe
                                                                                                                                                                                                                          C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                          PID:880
                                                                                                                                                                                                                          • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                            C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                              • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                                                                                "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                              • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                                                                                C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:548
                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                                                                  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:1528
                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:5068
                                                                                                                                                                                                                                    • C:\Users\Admin\Downloads\System Restore.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                      PID:1656
                                                                                                                                                                                                                                    • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                                                      C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:1700
                                                                                                                                                                                                                                      • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                                                                        C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                        PID:3224
                                                                                                                                                                                                                                      • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                                                                                        C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                        PID:2256
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                                                                        C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                        PID:1708
                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                          PID:3132
                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                      • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                                                                        C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                        PID:3720
                                                                                                                                                                                                                                      • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                        PID:4816
                                                                                                                                                                                                                                      • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                                                                        C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                        • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                                                                          C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                          PID:1504
                                                                                                                                                                                                                                      • C:\Users\Public\backup.exe
                                                                                                                                                                                                                                        C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                        PID:4212
                                                                                                                                                                                                                                        • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                                          C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:3132
                                                                                                                                                                                                                                          • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                                            C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:3016
                                                                                                                                                                                                                                            • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                                                              C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:3700
                                                                                                                                                                                                                                              • C:\Users\Public\Pictures\data.exe
                                                                                                                                                                                                                                                C:\Users\Public\Pictures\data.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:4292
                                                                                                                                                                                                                                                • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                                  C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:1384
                                                                                                                                                                                                                                              • C:\Windows\backup.exe
                                                                                                                                                                                                                                                C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                                • C:\Windows\addins\backup.exe
                                                                                                                                                                                                                                                  C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:2676
                                                                                                                                                                                                                                                  • C:\Windows\appcompat\backup.exe
                                                                                                                                                                                                                                                    C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                                                                    • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                                                                                      C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                      PID:1736
                                                                                                                                                                                                                                                      • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                                                                                        C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                        PID:448
                                                                                                                                                                                                                                                    • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                                                                      C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                      PID:316
                                                                                                                                                                                                                                                    • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                                                                      C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                      PID:3724
                                                                                                                                                                                                                                                  • C:\Windows\apppatch\backup.exe
                                                                                                                                                                                                                                                    C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:4604
                                                                                                                                                                                                                                                    • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                                                                                                                                      C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                                      • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                                                                                                                                        C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                          PID:3932
                                                                                                                                                                                                                                                      • C:\Windows\apppatch\AppPatch64\update.exe
                                                                                                                                                                                                                                                        C:\Windows\apppatch\AppPatch64\update.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                                                                        • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                                                                                                                                                          C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                          PID:3360
                                                                                                                                                                                                                                                        • C:\Windows\apppatch\de-DE\data.exe
                                                                                                                                                                                                                                                          C:\Windows\apppatch\de-DE\data.exe C:\Windows\apppatch\de-DE\
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                          PID:3464
                                                                                                                                                                                                                                                        • C:\Windows\apppatch\fr-FR\backup.exe
                                                                                                                                                                                                                                                          C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                          PID:3544
                                                                                                                                                                                                                                                        • C:\Windows\apppatch\es-ES\backup.exe
                                                                                                                                                                                                                                                          C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:2972
                                                                                                                                                                                                                                                          • C:\Windows\apppatch\en-US\data.exe
                                                                                                                                                                                                                                                            C:\Windows\apppatch\en-US\data.exe C:\Windows\apppatch\en-US\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                            PID:2976
                                                                                                                                                                                                                                                          • C:\Windows\apppatch\it-IT\backup.exe
                                                                                                                                                                                                                                                            C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:2132
                                                                                                                                                                                                                                                          • C:\Windows\AppReadiness\backup.exe
                                                                                                                                                                                                                                                            C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:1308
                                                                                                                                                                                                                                                            • C:\Windows\assembly\backup.exe
                                                                                                                                                                                                                                                              C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:3176
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:1624
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:2620
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:3276
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                        PID:1644
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:1656
                                                                                                                                                                                                                                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:2656
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:260
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                          PID:1724
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                            PID:2376
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:3940
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                              PID:3120
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4836
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\update.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                              PID:3668
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                PID:3016
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                  PID:4996
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                    PID:2792
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:4324
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\System\ado\backup.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                    PID:2320
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:796
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                      PID:3188
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:3868
                                                                                                                                                                                                                                                                      • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                                                                                                                                                        C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:2128
                                                                                                                                                                                                                                                                        • C:\Windows\assembly\GAC\ADODB\backup.exe
                                                                                                                                                                                                                                                                          C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:4352
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\data.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                          PID:3700
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1724

                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            75eb257a4ebb38c957e819ea10282167

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            d870d76dd43462461bb5fb5865a46f08de71c76f

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            b159f043fb105aba60a4901383f6ad5489614a6cf25facdfea62de6cd09d8c25

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            7deef3cc245a401195e5b45e81daa56afd7757dd2bc53588cd203bddfcaeb9f1b1b51b8a5c19185679a24715e547fb89bcafa0b17f6e6ad431394407ffa151b4

                                                                                                                                                                                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            75eb257a4ebb38c957e819ea10282167

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            d870d76dd43462461bb5fb5865a46f08de71c76f

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            b159f043fb105aba60a4901383f6ad5489614a6cf25facdfea62de6cd09d8c25

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            7deef3cc245a401195e5b45e81daa56afd7757dd2bc53588cd203bddfcaeb9f1b1b51b8a5c19185679a24715e547fb89bcafa0b17f6e6ad431394407ffa151b4

                                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            3df9f331d7ce5a2b30ffc7cd1863166e

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            b684be44ef62280d78152eed71e0f656d628d082

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            051695d02aec2072751d8d7615fcd4c6d61d17bb9adcbba6e071801c36ede0ab

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            5ec9024960b25e83d41715744098ca24ca5a3715c822d81bb6dd00563f2fad64ae1717c29ceac578271b39ce045f3f7d5669d3904e548db4924f9c6b1a0e47cf

                                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            3df9f331d7ce5a2b30ffc7cd1863166e

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            b684be44ef62280d78152eed71e0f656d628d082

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            051695d02aec2072751d8d7615fcd4c6d61d17bb9adcbba6e071801c36ede0ab

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            5ec9024960b25e83d41715744098ca24ca5a3715c822d81bb6dd00563f2fad64ae1717c29ceac578271b39ce045f3f7d5669d3904e548db4924f9c6b1a0e47cf

                                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            0cb905d7aeb3feebbba3913d4181c601

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            ca42070b76d6b1b872fee03cb46fc0f1b544a412

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            18005b791f35a58fdd0836cf609bd4614801cfcee3e8bdf6145d2d7b4a469dfd

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            f7cc8cff00a14f3cb392a50804db04d6a7bb3070b6d9674a39f7aa9f4383a60bc42d4c68e1c0cd1ad7867c66fbf2202bf056344d6aad35109c03f6cf952ba4e7

                                                                                                                                                                                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            0cb905d7aeb3feebbba3913d4181c601

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            ca42070b76d6b1b872fee03cb46fc0f1b544a412

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            18005b791f35a58fdd0836cf609bd4614801cfcee3e8bdf6145d2d7b4a469dfd

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            f7cc8cff00a14f3cb392a50804db04d6a7bb3070b6d9674a39f7aa9f4383a60bc42d4c68e1c0cd1ad7867c66fbf2202bf056344d6aad35109c03f6cf952ba4e7

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\DESIGNER\System Restore.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dda06b4d1dd16f467e9b4f69761452cc

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            752e08be3dc00301a351a7c413ce180680348dbf

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            1fda325dffbb15d352fa35caae9f8e91dd5622f33df95621507030a9e786d1ae

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            58e9d7173800c0e9275c7421bdc0c980259d3db2588f29d66aea176bc7e11a4aa805b7a04b933d790abbbc8bca7d7b99b2fbb8fc4c5874ba0abbc1469956d82a

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\DESIGNER\System Restore.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dda06b4d1dd16f467e9b4f69761452cc

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            752e08be3dc00301a351a7c413ce180680348dbf

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            1fda325dffbb15d352fa35caae9f8e91dd5622f33df95621507030a9e786d1ae

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            58e9d7173800c0e9275c7421bdc0c980259d3db2588f29d66aea176bc7e11a4aa805b7a04b933d790abbbc8bca7d7b99b2fbb8fc4c5874ba0abbc1469956d82a

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            47413a023d0326c0ac7dc1a5f714ba9f

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            7db1e6f33860a98d16b376903cd27f2a4d913fb4

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            91cf898ee4fb4baa4adf00f572e479fc96e2ffc32f8f32a3ac8366c4f2336bc6

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            6f07098ee344b997493dafbd38f49b8ac25121c0c20255daefdca3b6c48737195d7e414eefa6ca28aed8a85835e5d9664fe80bb438decf020d0aa29d54fce977

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            47413a023d0326c0ac7dc1a5f714ba9f

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            7db1e6f33860a98d16b376903cd27f2a4d913fb4

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            91cf898ee4fb4baa4adf00f572e479fc96e2ffc32f8f32a3ac8366c4f2336bc6

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            6f07098ee344b997493dafbd38f49b8ac25121c0c20255daefdca3b6c48737195d7e414eefa6ca28aed8a85835e5d9664fe80bb438decf020d0aa29d54fce977

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            6845f121165ffad1fa70b3f44e6a9074

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            43dfa33924cfbbf100d2e1b1662b9409d17c1ea1

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            52f87e4226b59e289b4b6ae02da295ca42f7efbc4097e702e0d2280b26f8a8f0

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            1f6ca4696b168480fabbef2eeb3a0a8dd3e82e1bbd78731b20e1b207ac518ebd817b17e15e81a77559cf3ec81e8abc1e760fe2f2ab346d17a1fa82858664e88e

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            6845f121165ffad1fa70b3f44e6a9074

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            43dfa33924cfbbf100d2e1b1662b9409d17c1ea1

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            52f87e4226b59e289b4b6ae02da295ca42f7efbc4097e702e0d2280b26f8a8f0

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            1f6ca4696b168480fabbef2eeb3a0a8dd3e82e1bbd78731b20e1b207ac518ebd817b17e15e81a77559cf3ec81e8abc1e760fe2f2ab346d17a1fa82858664e88e

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dda06b4d1dd16f467e9b4f69761452cc

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            752e08be3dc00301a351a7c413ce180680348dbf

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            1fda325dffbb15d352fa35caae9f8e91dd5622f33df95621507030a9e786d1ae

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            58e9d7173800c0e9275c7421bdc0c980259d3db2588f29d66aea176bc7e11a4aa805b7a04b933d790abbbc8bca7d7b99b2fbb8fc4c5874ba0abbc1469956d82a

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dda06b4d1dd16f467e9b4f69761452cc

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            752e08be3dc00301a351a7c413ce180680348dbf

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            1fda325dffbb15d352fa35caae9f8e91dd5622f33df95621507030a9e786d1ae

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            58e9d7173800c0e9275c7421bdc0c980259d3db2588f29d66aea176bc7e11a4aa805b7a04b933d790abbbc8bca7d7b99b2fbb8fc4c5874ba0abbc1469956d82a

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            cbfeda6a34ec79e6fbdb0403696b7465

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            c71e693cbeeba0a898032972ef1bacc92dc581f0

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            5b42399ef695e999270f374d7b53542fa0e20e6de7c5b76e0a5938317649f49b

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            b5f2c04e2af6baa2ec1e07229071d1ef5debe77ae2cbe62439bb93a84160084465b6ef226a5a28a0ae297969c5f8977aa725b2d26dba035e2e2c91a881f51ee2

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            cbfeda6a34ec79e6fbdb0403696b7465

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            c71e693cbeeba0a898032972ef1bacc92dc581f0

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            5b42399ef695e999270f374d7b53542fa0e20e6de7c5b76e0a5938317649f49b

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            b5f2c04e2af6baa2ec1e07229071d1ef5debe77ae2cbe62439bb93a84160084465b6ef226a5a28a0ae297969c5f8977aa725b2d26dba035e2e2c91a881f51ee2

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            6845f121165ffad1fa70b3f44e6a9074

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            43dfa33924cfbbf100d2e1b1662b9409d17c1ea1

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            52f87e4226b59e289b4b6ae02da295ca42f7efbc4097e702e0d2280b26f8a8f0

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            1f6ca4696b168480fabbef2eeb3a0a8dd3e82e1bbd78731b20e1b207ac518ebd817b17e15e81a77559cf3ec81e8abc1e760fe2f2ab346d17a1fa82858664e88e

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            6845f121165ffad1fa70b3f44e6a9074

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            43dfa33924cfbbf100d2e1b1662b9409d17c1ea1

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            52f87e4226b59e289b4b6ae02da295ca42f7efbc4097e702e0d2280b26f8a8f0

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            1f6ca4696b168480fabbef2eeb3a0a8dd3e82e1bbd78731b20e1b207ac518ebd817b17e15e81a77559cf3ec81e8abc1e760fe2f2ab346d17a1fa82858664e88e

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            cbfeda6a34ec79e6fbdb0403696b7465

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            c71e693cbeeba0a898032972ef1bacc92dc581f0

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            5b42399ef695e999270f374d7b53542fa0e20e6de7c5b76e0a5938317649f49b

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            b5f2c04e2af6baa2ec1e07229071d1ef5debe77ae2cbe62439bb93a84160084465b6ef226a5a28a0ae297969c5f8977aa725b2d26dba035e2e2c91a881f51ee2

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            cbfeda6a34ec79e6fbdb0403696b7465

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            c71e693cbeeba0a898032972ef1bacc92dc581f0

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            5b42399ef695e999270f374d7b53542fa0e20e6de7c5b76e0a5938317649f49b

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            b5f2c04e2af6baa2ec1e07229071d1ef5debe77ae2cbe62439bb93a84160084465b6ef226a5a28a0ae297969c5f8977aa725b2d26dba035e2e2c91a881f51ee2

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            de26eb466e806e9aa910ae815de058e0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            11d7b53b7d988a478fabbc7e4f28c0c1538f0c38

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            62b20afea860720cee29b88c0bd562ac6adc79c2ed15556946dc8b86907f9a8c

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c2bba6402073fd4c3c4dad5d57db04a03b762c2a59946e6ba1b9b972b2a4defdf5ab9935ed20514b682c8912c22c1ffe74baa18576c3703e88a94393ef53950c

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            de26eb466e806e9aa910ae815de058e0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            11d7b53b7d988a478fabbc7e4f28c0c1538f0c38

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            62b20afea860720cee29b88c0bd562ac6adc79c2ed15556946dc8b86907f9a8c

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c2bba6402073fd4c3c4dad5d57db04a03b762c2a59946e6ba1b9b972b2a4defdf5ab9935ed20514b682c8912c22c1ffe74baa18576c3703e88a94393ef53950c

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            de26eb466e806e9aa910ae815de058e0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            11d7b53b7d988a478fabbc7e4f28c0c1538f0c38

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            62b20afea860720cee29b88c0bd562ac6adc79c2ed15556946dc8b86907f9a8c

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c2bba6402073fd4c3c4dad5d57db04a03b762c2a59946e6ba1b9b972b2a4defdf5ab9935ed20514b682c8912c22c1ffe74baa18576c3703e88a94393ef53950c

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            de26eb466e806e9aa910ae815de058e0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            11d7b53b7d988a478fabbc7e4f28c0c1538f0c38

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            62b20afea860720cee29b88c0bd562ac6adc79c2ed15556946dc8b86907f9a8c

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c2bba6402073fd4c3c4dad5d57db04a03b762c2a59946e6ba1b9b972b2a4defdf5ab9935ed20514b682c8912c22c1ffe74baa18576c3703e88a94393ef53950c

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            de26eb466e806e9aa910ae815de058e0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            11d7b53b7d988a478fabbc7e4f28c0c1538f0c38

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            62b20afea860720cee29b88c0bd562ac6adc79c2ed15556946dc8b86907f9a8c

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c2bba6402073fd4c3c4dad5d57db04a03b762c2a59946e6ba1b9b972b2a4defdf5ab9935ed20514b682c8912c22c1ffe74baa18576c3703e88a94393ef53950c

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            de26eb466e806e9aa910ae815de058e0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            11d7b53b7d988a478fabbc7e4f28c0c1538f0c38

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            62b20afea860720cee29b88c0bd562ac6adc79c2ed15556946dc8b86907f9a8c

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c2bba6402073fd4c3c4dad5d57db04a03b762c2a59946e6ba1b9b972b2a4defdf5ab9935ed20514b682c8912c22c1ffe74baa18576c3703e88a94393ef53950c

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            f3a567738189e86f739c635021d1d3e8

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            48afe713a91ebe60cb694552a652282833c0019c

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            f0010f607d9c65c3a28b0a06455185ab268e99315c547bdaf462d3e329c955c8

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            6ba652b6145ed8ebf2b87d42aa6ee56b11e801323300df1ef9e68ba452b9533ac8b6b4f407f53cdd7d31033b4bd618ba0a87a1c89aa280582681f0fc4136bcd3

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            f3a567738189e86f739c635021d1d3e8

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            48afe713a91ebe60cb694552a652282833c0019c

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            f0010f607d9c65c3a28b0a06455185ab268e99315c547bdaf462d3e329c955c8

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            6ba652b6145ed8ebf2b87d42aa6ee56b11e801323300df1ef9e68ba452b9533ac8b6b4f407f53cdd7d31033b4bd618ba0a87a1c89aa280582681f0fc4136bcd3

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            dce6b58c6d825235cce0865a08000b04

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8680cffd2099fd4826f37ee67163dbad3ee889dd

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            7d6f6235a09366acdaabf10616e6a218626d51fa1c710e8996a7d721b3e48b2f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            23f49d5ffc879baafae28a81ded169ea883a7da0e8f0689d195c2bbfccb8cb36c09d0e3369cfdb20994fd0375980793e355ba50c6f4ec142581d4f15cf3fbcdf

                                                                                                                                                                                                                                                                          • C:\Program Files\update.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            75eb257a4ebb38c957e819ea10282167

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            d870d76dd43462461bb5fb5865a46f08de71c76f

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            b159f043fb105aba60a4901383f6ad5489614a6cf25facdfea62de6cd09d8c25

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            7deef3cc245a401195e5b45e81daa56afd7757dd2bc53588cd203bddfcaeb9f1b1b51b8a5c19185679a24715e547fb89bcafa0b17f6e6ad431394407ffa151b4

                                                                                                                                                                                                                                                                          • C:\Program Files\update.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            75eb257a4ebb38c957e819ea10282167

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            d870d76dd43462461bb5fb5865a46f08de71c76f

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            b159f043fb105aba60a4901383f6ad5489614a6cf25facdfea62de6cd09d8c25

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            7deef3cc245a401195e5b45e81daa56afd7757dd2bc53588cd203bddfcaeb9f1b1b51b8a5c19185679a24715e547fb89bcafa0b17f6e6ad431394407ffa151b4

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3028667159\update.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            e82ae5cf4f19422c82d56efac8dc25fc

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            72affb6072154995c5cd5ae85dec52e26fe19593

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            093afe9e252701dcd3c6692b3b2d96380ae63792007bab827e98dae43faca963

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            ad1db4ffe5b96db79c310fa1794cbc7c4637a377d751320dd0ed2b7c619b43ae6e3e861f8ec47e8c5e5414d9358bd6bdfef283cf093cdedd83548d81107a8d66

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3028667159\update.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            e82ae5cf4f19422c82d56efac8dc25fc

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            72affb6072154995c5cd5ae85dec52e26fe19593

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            093afe9e252701dcd3c6692b3b2d96380ae63792007bab827e98dae43faca963

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            ad1db4ffe5b96db79c310fa1794cbc7c4637a377d751320dd0ed2b7c619b43ae6e3e861f8ec47e8c5e5414d9358bd6bdfef283cf093cdedd83548d81107a8d66

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            8b573f563b5467fea1d0957b0c9951ad

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8459c28c52640f0c3394956bc9092ac173e5643a

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            3002e5e15cf8168b69f31cdee02a3b3a380e7a3ad8c007f8cd25f5cbc23589d8

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            162946d951754b0f6ecdf6642f1f55a6cc2933c6bcbf7aceac4a6c34f926c0486594cc853bd444afd32949a933ec524ce24fa19f1fd46296d97eae10d91c9907

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            8b573f563b5467fea1d0957b0c9951ad

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8459c28c52640f0c3394956bc9092ac173e5643a

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            3002e5e15cf8168b69f31cdee02a3b3a380e7a3ad8c007f8cd25f5cbc23589d8

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            162946d951754b0f6ecdf6642f1f55a6cc2933c6bcbf7aceac4a6c34f926c0486594cc853bd444afd32949a933ec524ce24fa19f1fd46296d97eae10d91c9907

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            a301f40cb35188fa256ff70a47118bc0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            b6e6b185d5b940a50e27a1c79f1ff81db6a26bcc

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            021142bbbb7a99d3ec536ea094c42bccd56b45fe73a421364ca5f8505c5e0250

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            2707d375fcedace4e92327a0ba7000e35a5ea11a02eb6048e96dc8dcc924543433f7336fce7d52fc4c4d6935bfbdef16285ad01a402198cafb4087e6588c18ce

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            a301f40cb35188fa256ff70a47118bc0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            b6e6b185d5b940a50e27a1c79f1ff81db6a26bcc

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            021142bbbb7a99d3ec536ea094c42bccd56b45fe73a421364ca5f8505c5e0250

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            2707d375fcedace4e92327a0ba7000e35a5ea11a02eb6048e96dc8dcc924543433f7336fce7d52fc4c4d6935bfbdef16285ad01a402198cafb4087e6588c18ce

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            a301f40cb35188fa256ff70a47118bc0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            b6e6b185d5b940a50e27a1c79f1ff81db6a26bcc

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            021142bbbb7a99d3ec536ea094c42bccd56b45fe73a421364ca5f8505c5e0250

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            2707d375fcedace4e92327a0ba7000e35a5ea11a02eb6048e96dc8dcc924543433f7336fce7d52fc4c4d6935bfbdef16285ad01a402198cafb4087e6588c18ce

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            a301f40cb35188fa256ff70a47118bc0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            b6e6b185d5b940a50e27a1c79f1ff81db6a26bcc

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            021142bbbb7a99d3ec536ea094c42bccd56b45fe73a421364ca5f8505c5e0250

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            2707d375fcedace4e92327a0ba7000e35a5ea11a02eb6048e96dc8dcc924543433f7336fce7d52fc4c4d6935bfbdef16285ad01a402198cafb4087e6588c18ce

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            e82ae5cf4f19422c82d56efac8dc25fc

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            72affb6072154995c5cd5ae85dec52e26fe19593

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            093afe9e252701dcd3c6692b3b2d96380ae63792007bab827e98dae43faca963

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            ad1db4ffe5b96db79c310fa1794cbc7c4637a377d751320dd0ed2b7c619b43ae6e3e861f8ec47e8c5e5414d9358bd6bdfef283cf093cdedd83548d81107a8d66

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            e82ae5cf4f19422c82d56efac8dc25fc

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            72affb6072154995c5cd5ae85dec52e26fe19593

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            093afe9e252701dcd3c6692b3b2d96380ae63792007bab827e98dae43faca963

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            ad1db4ffe5b96db79c310fa1794cbc7c4637a377d751320dd0ed2b7c619b43ae6e3e861f8ec47e8c5e5414d9358bd6bdfef283cf093cdedd83548d81107a8d66

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            8b573f563b5467fea1d0957b0c9951ad

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8459c28c52640f0c3394956bc9092ac173e5643a

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            3002e5e15cf8168b69f31cdee02a3b3a380e7a3ad8c007f8cd25f5cbc23589d8

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            162946d951754b0f6ecdf6642f1f55a6cc2933c6bcbf7aceac4a6c34f926c0486594cc853bd444afd32949a933ec524ce24fa19f1fd46296d97eae10d91c9907

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            8b573f563b5467fea1d0957b0c9951ad

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            8459c28c52640f0c3394956bc9092ac173e5643a

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            3002e5e15cf8168b69f31cdee02a3b3a380e7a3ad8c007f8cd25f5cbc23589d8

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            162946d951754b0f6ecdf6642f1f55a6cc2933c6bcbf7aceac4a6c34f926c0486594cc853bd444afd32949a933ec524ce24fa19f1fd46296d97eae10d91c9907

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            f5fc8be097568e1c0a9205adfe52d470

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            4085b2da23d9a35bbc02ebb3b4e3dd574a2df60b

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            725b9661073f7260ab8c3d9e4640eb09a5f1d8667d8855314286a4c12cd93037

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c6f04686aaf019e7d990536862be00c02d7696c05582b0afa12d32a7a06ae5258d58c76ecdb9e487daea7abaa168ecad55aaf6d151912a12b25507024c96305b

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            f5fc8be097568e1c0a9205adfe52d470

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            4085b2da23d9a35bbc02ebb3b4e3dd574a2df60b

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            725b9661073f7260ab8c3d9e4640eb09a5f1d8667d8855314286a4c12cd93037

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c6f04686aaf019e7d990536862be00c02d7696c05582b0afa12d32a7a06ae5258d58c76ecdb9e487daea7abaa168ecad55aaf6d151912a12b25507024c96305b

                                                                                                                                                                                                                                                                          • C:\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            d589862f5f30da0eb78391bc403be9a1

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            ff98b4237b29a6c0bb6dcab939c8fb34f53e95c6

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            e742119172c53a254b36b5873b88d7301c7402f1074a096a0e94a456763ffc0d

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            3a9702f1f2c390434ea5b9add7fe9837ae196f53d6163fbf7e8fb3accd57b51222db129e03d31159b23d1fbe4a3d54981748ef8294d9522462ed0b19dfe08b24

                                                                                                                                                                                                                                                                          • C:\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            d589862f5f30da0eb78391bc403be9a1

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            ff98b4237b29a6c0bb6dcab939c8fb34f53e95c6

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            e742119172c53a254b36b5873b88d7301c7402f1074a096a0e94a456763ffc0d

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            3a9702f1f2c390434ea5b9add7fe9837ae196f53d6163fbf7e8fb3accd57b51222db129e03d31159b23d1fbe4a3d54981748ef8294d9522462ed0b19dfe08b24

                                                                                                                                                                                                                                                                          • C:\odt\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            beeebbac5d7bd78508febebbdb1ddbb0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            9ef0d1872bd9de52d09be934a6643c141c3163f2

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            984d1e9811a7959c30dc5775c7c576d8ffb5b93101d8062fcf5eb3e9d309198e

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c8b9d1d48d979e1830943529467f214e6bb279b4ce7c7d535902f3607fa16ebaafcb7e238e6cdf56767885027225912f07e4d61d3b7b769b2ce49547378e0919

                                                                                                                                                                                                                                                                          • C:\odt\backup.exe

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            beeebbac5d7bd78508febebbdb1ddbb0

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            9ef0d1872bd9de52d09be934a6643c141c3163f2

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            984d1e9811a7959c30dc5775c7c576d8ffb5b93101d8062fcf5eb3e9d309198e

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            c8b9d1d48d979e1830943529467f214e6bb279b4ce7c7d535902f3607fa16ebaafcb7e238e6cdf56767885027225912f07e4d61d3b7b769b2ce49547378e0919