Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 17:44

General

  • Target

    542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe

  • Size

    72KB

  • MD5

    0cd80e7db3a774592c4e31da708c072e

  • SHA1

    4f4cd6480c2e96496dbba401cdb400b255899ad1

  • SHA256

    542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540

  • SHA512

    6ea57b3562517aded33990a152469e94dd865b7885cfed0c6ebf3712bb87acf99813389636fb57aa7600e5a8eced292c4bd2ba1e77ddc37b0811d6f96fca2d48

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2f:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrT

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe
    "C:\Users\Admin\AppData\Local\Temp\542597edfeadb965a547d8b2a879f50500ae63e7fb355f3651018f5e821af540.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\2210577132\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2210577132\backup.exe C:\Users\Admin\AppData\Local\Temp\2210577132\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2244
      • C:\System Restore.exe
        "\System Restore.exe" \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1376
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1444
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2688
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4964
          • C:\Program Files\7-Zip\System Restore.exe
            "C:\Program Files\7-Zip\System Restore.exe" C:\Program Files\7-Zip\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1816
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1428
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1380
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3036
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4624
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3308
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2312
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1460
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2256
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2460
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4600
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3832
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2448
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3084
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4532
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2664
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2052
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4628
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1708
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1120
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4888
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4920
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1448
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2084
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4280
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3460
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3272
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2168
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3804
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1188
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2820
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4120
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2192
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3092
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5032
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2856
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:4224
                • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                  8⤵
                    PID:4696
                  • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                    8⤵
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:4856
                  • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:4952
                  • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:3120
                  • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:4116
                  • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:4020
                  • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:5032
                  • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1920
                  • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                    8⤵
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:2052
                  • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                    8⤵
                      PID:4764
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\data.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1256
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4988
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                      8⤵
                      • Executes dropped EXE
                      PID:3632
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                      8⤵
                        PID:372
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • System policy modification
                        PID:4612
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                        8⤵
                          PID:2492
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:3332
                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                        7⤵
                          PID:4252
                        • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                          7⤵
                          • System policy modification
                          PID:1996
                        • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                          7⤵
                            PID:2008
                          • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                            7⤵
                            • Drops file in Program Files directory
                            PID:4004
                            • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\System Restore.exe
                              "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\System Restore.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                              8⤵
                                PID:3396
                            • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:4984
                            • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                              7⤵
                                PID:3456
                                • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                  8⤵
                                    PID:4432
                              • C:\Program Files\Common Files\Services\backup.exe
                                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:3816
                              • C:\Program Files\Common Files\System\backup.exe
                                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:4468
                                • C:\Program Files\Common Files\System\ado\System Restore.exe
                                  "C:\Program Files\Common Files\System\ado\System Restore.exe" C:\Program Files\Common Files\System\ado\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:5012
                                  • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:4848
                                  • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                    "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:2008
                                  • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                    "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:4276
                                  • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                    "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                    8⤵
                                      PID:3464
                                    • C:\Program Files\Common Files\System\ado\it-IT\update.exe
                                      "C:\Program Files\Common Files\System\ado\it-IT\update.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                      8⤵
                                      • Disables RegEdit via registry modification
                                      PID:1088
                                    • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                      8⤵
                                        PID:3084
                                    • C:\Program Files\Common Files\System\de-DE\backup.exe
                                      "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                      7⤵
                                      • Disables RegEdit via registry modification
                                      PID:1120
                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:2220
                                    • C:\Program Files\Common Files\System\it-IT\backup.exe
                                      "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:4288
                                    • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                      "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                      7⤵
                                      • Disables RegEdit via registry modification
                                      PID:4888
                                    • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                      "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:1452
                                    • C:\Program Files\Common Files\System\es-ES\backup.exe
                                      "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                      7⤵
                                      • Disables RegEdit via registry modification
                                      PID:3048
                                    • C:\Program Files\Common Files\System\msadc\backup.exe
                                      "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                      7⤵
                                        PID:2692
                                  • C:\Program Files\Google\backup.exe
                                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                    5⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:2276
                                    • C:\Program Files\Google\Chrome\backup.exe
                                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:804
                                      • C:\Program Files\Google\Chrome\Application\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                        7⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4928
                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2036
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                            9⤵
                                            • Disables RegEdit via registry modification
                                            PID:3512
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                            9⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:1920
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                            9⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:3276
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                            9⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:1564
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                            9⤵
                                            • Disables RegEdit via registry modification
                                            • System policy modification
                                            PID:1916
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                            9⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:4524
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                            9⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:3840
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                            9⤵
                                            • Disables RegEdit via registry modification
                                            • Drops file in Program Files directory
                                            PID:3408
                                        • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                          "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          PID:1472
                                  • C:\Program Files\Internet Explorer\backup.exe
                                    "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                    5⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:4280
                                    • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                      "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                      6⤵
                                      • Disables RegEdit via registry modification
                                      PID:4644
                                    • C:\Program Files\Internet Explorer\en-US\backup.exe
                                      "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:4904
                                    • C:\Program Files\Internet Explorer\images\backup.exe
                                      "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System policy modification
                                      PID:1692
                                    • C:\Program Files\Internet Explorer\fr-FR\update.exe
                                      "C:\Program Files\Internet Explorer\fr-FR\update.exe" C:\Program Files\Internet Explorer\fr-FR\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:4884
                                    • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                      "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                      6⤵
                                        PID:1856
                                      • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                        "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                        6⤵
                                          PID:1292
                                      • C:\Program Files\Java\backup.exe
                                        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                        5⤵
                                        • Drops file in Program Files directory
                                        PID:4444
                                        • C:\Program Files\Java\jdk1.8.0_66\data.exe
                                          "C:\Program Files\Java\jdk1.8.0_66\data.exe" C:\Program Files\Java\jdk1.8.0_66\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Drops file in Program Files directory
                                          PID:5036
                                          • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                            "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                            7⤵
                                            • System policy modification
                                            PID:840
                                            • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                              "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                              8⤵
                                                PID:4116
                                              • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                8⤵
                                                  PID:4740
                                              • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                7⤵
                                                • System policy modification
                                                PID:3304
                                        • C:\Program Files (x86)\backup.exe
                                          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                          4⤵
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:4660
                                          • C:\Program Files (x86)\Adobe\backup.exe
                                            "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                            5⤵
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3364
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                              6⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:5020
                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                7⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4328
                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Drops file in Program Files directory
                                                PID:3524
                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                  8⤵
                                                  • Disables RegEdit via registry modification
                                                  • System policy modification
                                                  PID:1876
                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                    9⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:4288
                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                  8⤵
                                                  • Disables RegEdit via registry modification
                                                  PID:2440
                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                    9⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System policy modification
                                                    PID:1528
                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                  8⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  PID:4748
                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                  8⤵
                                                  • Disables RegEdit via registry modification
                                                  • System policy modification
                                                  PID:1388
                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                  8⤵
                                                    PID:2924
                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\data.exe
                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                      9⤵
                                                        PID:4912
                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                      8⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System policy modification
                                                      PID:2664
                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                      8⤵
                                                      • Disables RegEdit via registry modification
                                                      • Drops file in Program Files directory
                                                      • System policy modification
                                                      PID:4372
                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\System Restore.exe
                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                      8⤵
                                                        PID:4220
                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                      7⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Drops file in Program Files directory
                                                      PID:2148
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                        8⤵
                                                        • Drops file in Program Files directory
                                                        • System policy modification
                                                        PID:3952
                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                          9⤵
                                                          • Disables RegEdit via registry modification
                                                          PID:1544
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                        8⤵
                                                          PID:3836
                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                          8⤵
                                                            PID:1328
                                                    • C:\Program Files (x86)\Common Files\backup.exe
                                                      "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                      5⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Drops file in Program Files directory
                                                      PID:5100
                                                      • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                        "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                        6⤵
                                                        • Drops file in Program Files directory
                                                        • System policy modification
                                                        PID:5052
                                                        • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                          "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                          7⤵
                                                            PID:1308
                                                      • C:\Program Files (x86)\Google\backup.exe
                                                        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                        5⤵
                                                        • Drops file in Program Files directory
                                                        • System policy modification
                                                        PID:1016
                                                        • C:\Program Files (x86)\Google\Temp\update.exe
                                                          "C:\Program Files (x86)\Google\Temp\update.exe" C:\Program Files (x86)\Google\Temp\
                                                          6⤵
                                                          • System policy modification
                                                          PID:2272
                                                        • C:\Program Files (x86)\Google\Update\backup.exe
                                                          "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                          6⤵
                                                          • Disables RegEdit via registry modification
                                                          • Drops file in Program Files directory
                                                          • System policy modification
                                                          PID:3508
                                                          • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                            "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                            7⤵
                                                              PID:5088
                                                          • C:\Program Files (x86)\Google\Policies\backup.exe
                                                            "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                            6⤵
                                                              PID:1432
                                                            • C:\Program Files (x86)\Google\CrashReports\update.exe
                                                              "C:\Program Files (x86)\Google\CrashReports\update.exe" C:\Program Files (x86)\Google\CrashReports\
                                                              6⤵
                                                              • Disables RegEdit via registry modification
                                                              PID:3736
                                                        • C:\Users\backup.exe
                                                          C:\Users\backup.exe C:\Users\
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2160
                                                          • C:\Users\Admin\backup.exe
                                                            C:\Users\Admin\backup.exe C:\Users\Admin\
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:832
                                                            • C:\Users\Admin\3D Objects\backup.exe
                                                              "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                              6⤵
                                                                PID:1868
                                                              • C:\Users\Admin\Contacts\backup.exe
                                                                C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                6⤵
                                                                  PID:1664
                                                                • C:\Users\Admin\Desktop\backup.exe
                                                                  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:3036
                                                                • C:\Users\Admin\Documents\backup.exe
                                                                  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System policy modification
                                                                  PID:1260
                                                                • C:\Users\Admin\Downloads\backup.exe
                                                                  C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                  6⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:3836
                                                                • C:\Users\Admin\Music\backup.exe
                                                                  C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:4460
                                                                • C:\Users\Admin\Links\backup.exe
                                                                  C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:2364
                                                                • C:\Users\Admin\Favorites\backup.exe
                                                                  C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                  6⤵
                                                                    PID:3676
                                                                  • C:\Users\Admin\OneDrive\backup.exe
                                                                    C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                    6⤵
                                                                      PID:2004
                                                                    • C:\Users\Admin\Pictures\backup.exe
                                                                      C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • System policy modification
                                                                      PID:3088
                                                                      • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                        "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                        7⤵
                                                                          PID:4060
                                                                        • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                          "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                          7⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:2576
                                                                      • C:\Users\Admin\Saved Games\backup.exe
                                                                        "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                        6⤵
                                                                          PID:2468
                                                                        • C:\Users\Admin\Searches\update.exe
                                                                          C:\Users\Admin\Searches\update.exe C:\Users\Admin\Searches\
                                                                          6⤵
                                                                          • System policy modification
                                                                          PID:2824
                                                                        • C:\Users\Admin\Videos\backup.exe
                                                                          C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                          6⤵
                                                                            PID:5060
                                                                        • C:\Users\Public\backup.exe
                                                                          C:\Users\Public\backup.exe C:\Users\Public\
                                                                          5⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:4868
                                                                          • C:\Users\Public\Music\backup.exe
                                                                            C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                            6⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • System policy modification
                                                                            PID:1384
                                                                          • C:\Users\Public\Downloads\backup.exe
                                                                            C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                            6⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:1348
                                                                          • C:\Users\Public\Documents\System Restore.exe
                                                                            "C:\Users\Public\Documents\System Restore.exe" C:\Users\Public\Documents\
                                                                            6⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • System policy modification
                                                                            PID:752
                                                                          • C:\Users\Public\Pictures\backup.exe
                                                                            C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                            6⤵
                                                                              PID:4100
                                                                            • C:\Users\Public\Videos\backup.exe
                                                                              C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                              6⤵
                                                                                PID:1916
                                                                          • C:\Windows\backup.exe
                                                                            C:\Windows\backup.exe C:\Windows\
                                                                            4⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Drops file in Windows directory
                                                                            PID:1372
                                                                            • C:\Windows\addins\System Restore.exe
                                                                              "C:\Windows\addins\System Restore.exe" C:\Windows\addins\
                                                                              5⤵
                                                                              • System policy modification
                                                                              PID:1056
                                                                            • C:\Windows\appcompat\backup.exe
                                                                              C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                              5⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • Drops file in Windows directory
                                                                              PID:1756
                                                                              • C:\Windows\appcompat\appraiser\backup.exe
                                                                                C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                6⤵
                                                                                • Disables RegEdit via registry modification
                                                                                • Drops file in Windows directory
                                                                                PID:3684
                                                                                • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                  C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                  7⤵
                                                                                    PID:3320
                                                                                • C:\Windows\appcompat\encapsulation\System Restore.exe
                                                                                  "C:\Windows\appcompat\encapsulation\System Restore.exe" C:\Windows\appcompat\encapsulation\
                                                                                  6⤵
                                                                                    PID:3740
                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:3752
                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:3968
                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5064
                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4988
                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4944
                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:2780
                                                                        • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\System Restore.exe
                                                                          "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\System Restore.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                                                          1⤵
                                                                          • Disables RegEdit via registry modification
                                                                          PID:3884
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                          1⤵
                                                                          • System policy modification
                                                                          PID:1192
                                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                          "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                          1⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Drops file in Program Files directory
                                                                          • System policy modification
                                                                          PID:4696
                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\update.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\update.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                            2⤵
                                                                              PID:3904
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                            1⤵
                                                                              PID:3276
                                                                            • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                              "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                              1⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Drops file in Program Files directory
                                                                              PID:1868
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                              1⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Drops file in Program Files directory
                                                                              PID:2344
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                              1⤵
                                                                                PID:1716
                                                                              • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                1⤵
                                                                                  PID:3884

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v6

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\PerfLogs\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  7814cf379b7c8ba3af275263ac1654c2

                                                                                  SHA1

                                                                                  0201cfa55973c6d84676ada42c15ad187d9450dc

                                                                                  SHA256

                                                                                  fb890d7204609c35f37de1ddabcee367d7e156052029975180d56950bbe0a095

                                                                                  SHA512

                                                                                  208bc83bfba9730e30edc67e3b7b07e3430d6c9829d40a4b97385a11c803b4879b30300bc6547f39d762338d1ca6603d051c56a50284f7e0577da7acf5c4d405

                                                                                • C:\PerfLogs\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  7814cf379b7c8ba3af275263ac1654c2

                                                                                  SHA1

                                                                                  0201cfa55973c6d84676ada42c15ad187d9450dc

                                                                                  SHA256

                                                                                  fb890d7204609c35f37de1ddabcee367d7e156052029975180d56950bbe0a095

                                                                                  SHA512

                                                                                  208bc83bfba9730e30edc67e3b7b07e3430d6c9829d40a4b97385a11c803b4879b30300bc6547f39d762338d1ca6603d051c56a50284f7e0577da7acf5c4d405

                                                                                • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  2d52d6591c97f3c6eb5bc8d87e8e82ce

                                                                                  SHA1

                                                                                  a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb

                                                                                  SHA256

                                                                                  2f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5

                                                                                  SHA512

                                                                                  9f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f

                                                                                • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  2d52d6591c97f3c6eb5bc8d87e8e82ce

                                                                                  SHA1

                                                                                  a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb

                                                                                  SHA256

                                                                                  2f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5

                                                                                  SHA512

                                                                                  9f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f

                                                                                • C:\Program Files\7-Zip\System Restore.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  a608f0f90ea07c5551a496d839eeefe0

                                                                                  SHA1

                                                                                  eada435df4dcfcd96031cb27ed66dbc132fab2b6

                                                                                  SHA256

                                                                                  2a3fd1da03d51985c55ba5c8071ddbc6a64cefd9ec2c876e372ea6440a0c45d8

                                                                                  SHA512

                                                                                  15b2baaae632ed7bacdf0f04847d6d711a5f27dfc61b4f8246b14ddee31e0eb8289b77a87ff1e4181e58a04bff4c4534421acbb983cae481a613642593f460d6

                                                                                • C:\Program Files\7-Zip\System Restore.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  a608f0f90ea07c5551a496d839eeefe0

                                                                                  SHA1

                                                                                  eada435df4dcfcd96031cb27ed66dbc132fab2b6

                                                                                  SHA256

                                                                                  2a3fd1da03d51985c55ba5c8071ddbc6a64cefd9ec2c876e372ea6440a0c45d8

                                                                                  SHA512

                                                                                  15b2baaae632ed7bacdf0f04847d6d711a5f27dfc61b4f8246b14ddee31e0eb8289b77a87ff1e4181e58a04bff4c4534421acbb983cae481a613642593f460d6

                                                                                • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  2d52d6591c97f3c6eb5bc8d87e8e82ce

                                                                                  SHA1

                                                                                  a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb

                                                                                  SHA256

                                                                                  2f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5

                                                                                  SHA512

                                                                                  9f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f

                                                                                • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  2d52d6591c97f3c6eb5bc8d87e8e82ce

                                                                                  SHA1

                                                                                  a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb

                                                                                  SHA256

                                                                                  2f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5

                                                                                  SHA512

                                                                                  9f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f

                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  a608f0f90ea07c5551a496d839eeefe0

                                                                                  SHA1

                                                                                  eada435df4dcfcd96031cb27ed66dbc132fab2b6

                                                                                  SHA256

                                                                                  2a3fd1da03d51985c55ba5c8071ddbc6a64cefd9ec2c876e372ea6440a0c45d8

                                                                                  SHA512

                                                                                  15b2baaae632ed7bacdf0f04847d6d711a5f27dfc61b4f8246b14ddee31e0eb8289b77a87ff1e4181e58a04bff4c4534421acbb983cae481a613642593f460d6

                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  a608f0f90ea07c5551a496d839eeefe0

                                                                                  SHA1

                                                                                  eada435df4dcfcd96031cb27ed66dbc132fab2b6

                                                                                  SHA256

                                                                                  2a3fd1da03d51985c55ba5c8071ddbc6a64cefd9ec2c876e372ea6440a0c45d8

                                                                                  SHA512

                                                                                  15b2baaae632ed7bacdf0f04847d6d711a5f27dfc61b4f8246b14ddee31e0eb8289b77a87ff1e4181e58a04bff4c4534421acbb983cae481a613642593f460d6

                                                                                • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ec631bcb63271d64466bf491783e6550

                                                                                  SHA1

                                                                                  a423f5e5e2c5601c4e92808ca65ee5bdd261e214

                                                                                  SHA256

                                                                                  eba1dbf07409fd0c0976231d1e79814a8785d57714af6c380f708973bc1a07ef

                                                                                  SHA512

                                                                                  4dbd2165d5088779c09d480613d6dd602b65cf1981448881ee7662f95a1868f31b738b6697facdbea5a118ea32364bec585686b4129819a8dca227f136477f13

                                                                                • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ec631bcb63271d64466bf491783e6550

                                                                                  SHA1

                                                                                  a423f5e5e2c5601c4e92808ca65ee5bdd261e214

                                                                                  SHA256

                                                                                  eba1dbf07409fd0c0976231d1e79814a8785d57714af6c380f708973bc1a07ef

                                                                                  SHA512

                                                                                  4dbd2165d5088779c09d480613d6dd602b65cf1981448881ee7662f95a1868f31b738b6697facdbea5a118ea32364bec585686b4129819a8dca227f136477f13

                                                                                • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  2d52d6591c97f3c6eb5bc8d87e8e82ce

                                                                                  SHA1

                                                                                  a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb

                                                                                  SHA256

                                                                                  2f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5

                                                                                  SHA512

                                                                                  9f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f

                                                                                • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  2d52d6591c97f3c6eb5bc8d87e8e82ce

                                                                                  SHA1

                                                                                  a2eb5cbd6a17666da4cf6d04176b5ec1a1b367fb

                                                                                  SHA256

                                                                                  2f45465f2fa1edccb88f1441e2f2c2597609b881b6bb8d70bec520448a4fb0d5

                                                                                  SHA512

                                                                                  9f5b502708f7097d4fd123aa737f0405ee0604764dfcd41b5c0212460e0a593bd219a94a733fdead0cea541ec5fe932de5da4e21b4be53bb3b2074b8978a627f

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  37cda5945fba47664776e6ec5460af78

                                                                                  SHA1

                                                                                  061f0611615e0431f0733cf5bc7e604d6c00ce6d

                                                                                  SHA256

                                                                                  106d5056ec592446b086d69f0e7c41dc96bf56b2b7bdce748ad9242559972060

                                                                                  SHA512

                                                                                  9162437c787419a51c127118d80d29408e22b9d67aab44d68d646973eb23601b9bb30386a65a225e745e4b82e2177124849f53fed322b098bcd6b0216309f046

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  37cda5945fba47664776e6ec5460af78

                                                                                  SHA1

                                                                                  061f0611615e0431f0733cf5bc7e604d6c00ce6d

                                                                                  SHA256

                                                                                  106d5056ec592446b086d69f0e7c41dc96bf56b2b7bdce748ad9242559972060

                                                                                  SHA512

                                                                                  9162437c787419a51c127118d80d29408e22b9d67aab44d68d646973eb23601b9bb30386a65a225e745e4b82e2177124849f53fed322b098bcd6b0216309f046

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ec631bcb63271d64466bf491783e6550

                                                                                  SHA1

                                                                                  a423f5e5e2c5601c4e92808ca65ee5bdd261e214

                                                                                  SHA256

                                                                                  eba1dbf07409fd0c0976231d1e79814a8785d57714af6c380f708973bc1a07ef

                                                                                  SHA512

                                                                                  4dbd2165d5088779c09d480613d6dd602b65cf1981448881ee7662f95a1868f31b738b6697facdbea5a118ea32364bec585686b4129819a8dca227f136477f13

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ec631bcb63271d64466bf491783e6550

                                                                                  SHA1

                                                                                  a423f5e5e2c5601c4e92808ca65ee5bdd261e214

                                                                                  SHA256

                                                                                  eba1dbf07409fd0c0976231d1e79814a8785d57714af6c380f708973bc1a07ef

                                                                                  SHA512

                                                                                  4dbd2165d5088779c09d480613d6dd602b65cf1981448881ee7662f95a1868f31b738b6697facdbea5a118ea32364bec585686b4129819a8dca227f136477f13

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  402608c79c49fc6fd599613cd6b22a7c

                                                                                  SHA1

                                                                                  74ef026c1366392f6608bc4d1c60fc5ed04b4e8e

                                                                                  SHA256

                                                                                  85f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2

                                                                                  SHA512

                                                                                  24a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  402608c79c49fc6fd599613cd6b22a7c

                                                                                  SHA1

                                                                                  74ef026c1366392f6608bc4d1c60fc5ed04b4e8e

                                                                                  SHA256

                                                                                  85f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2

                                                                                  SHA512

                                                                                  24a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  402608c79c49fc6fd599613cd6b22a7c

                                                                                  SHA1

                                                                                  74ef026c1366392f6608bc4d1c60fc5ed04b4e8e

                                                                                  SHA256

                                                                                  85f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2

                                                                                  SHA512

                                                                                  24a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  402608c79c49fc6fd599613cd6b22a7c

                                                                                  SHA1

                                                                                  74ef026c1366392f6608bc4d1c60fc5ed04b4e8e

                                                                                  SHA256

                                                                                  85f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2

                                                                                  SHA512

                                                                                  24a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  402608c79c49fc6fd599613cd6b22a7c

                                                                                  SHA1

                                                                                  74ef026c1366392f6608bc4d1c60fc5ed04b4e8e

                                                                                  SHA256

                                                                                  85f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2

                                                                                  SHA512

                                                                                  24a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  402608c79c49fc6fd599613cd6b22a7c

                                                                                  SHA1

                                                                                  74ef026c1366392f6608bc4d1c60fc5ed04b4e8e

                                                                                  SHA256

                                                                                  85f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2

                                                                                  SHA512

                                                                                  24a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  402608c79c49fc6fd599613cd6b22a7c

                                                                                  SHA1

                                                                                  74ef026c1366392f6608bc4d1c60fc5ed04b4e8e

                                                                                  SHA256

                                                                                  85f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2

                                                                                  SHA512

                                                                                  24a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  402608c79c49fc6fd599613cd6b22a7c

                                                                                  SHA1

                                                                                  74ef026c1366392f6608bc4d1c60fc5ed04b4e8e

                                                                                  SHA256

                                                                                  85f652b9dc541d9ddd5fd4a906110e1c98f065b1ce077fc722a50c6f1f939db2

                                                                                  SHA512

                                                                                  24a9580c6c604e8a38d836fadf37602d7b169891006e7a630a85207c00ea2656ca629c199addd3e485ecdfbb90e588e7c72aa810b219ff7ed93c8b08b9e1c523

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ebeeafe22349449ca060b63532816fcd

                                                                                  SHA1

                                                                                  b49571ff1093951df255c0628360245093477420

                                                                                  SHA256

                                                                                  e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a

                                                                                  SHA512

                                                                                  f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ebeeafe22349449ca060b63532816fcd

                                                                                  SHA1

                                                                                  b49571ff1093951df255c0628360245093477420

                                                                                  SHA256

                                                                                  e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a

                                                                                  SHA512

                                                                                  f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ebeeafe22349449ca060b63532816fcd

                                                                                  SHA1

                                                                                  b49571ff1093951df255c0628360245093477420

                                                                                  SHA256

                                                                                  e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a

                                                                                  SHA512

                                                                                  f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ebeeafe22349449ca060b63532816fcd

                                                                                  SHA1

                                                                                  b49571ff1093951df255c0628360245093477420

                                                                                  SHA256

                                                                                  e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a

                                                                                  SHA512

                                                                                  f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ebeeafe22349449ca060b63532816fcd

                                                                                  SHA1

                                                                                  b49571ff1093951df255c0628360245093477420

                                                                                  SHA256

                                                                                  e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a

                                                                                  SHA512

                                                                                  f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ebeeafe22349449ca060b63532816fcd

                                                                                  SHA1

                                                                                  b49571ff1093951df255c0628360245093477420

                                                                                  SHA256

                                                                                  e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a

                                                                                  SHA512

                                                                                  f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ebeeafe22349449ca060b63532816fcd

                                                                                  SHA1

                                                                                  b49571ff1093951df255c0628360245093477420

                                                                                  SHA256

                                                                                  e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a

                                                                                  SHA512

                                                                                  f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  ebeeafe22349449ca060b63532816fcd

                                                                                  SHA1

                                                                                  b49571ff1093951df255c0628360245093477420

                                                                                  SHA256

                                                                                  e18d23f8f7ff4daf056f7808b2c67b548edba9c835639c158387187f76ae983a

                                                                                  SHA512

                                                                                  f5329ad62b96b228045f3cc1ddec1614ce22b74dbb454b5c0ba2db1a2c18bb4c9081e6424683d5f41f039a4c1f2b08249170d03228e528f4716ea2cbea929227

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  75241375a32f913ff4424adf21d0aa89

                                                                                  SHA1

                                                                                  cf9d0d748e527902e9ddc31dc4a1ef501f0661be

                                                                                  SHA256

                                                                                  e478d6458214ef37d0028d5031436e9dd64ed86f9cbbf51b3a8b10d91ece277a

                                                                                  SHA512

                                                                                  96e527da26eb569359fc9e4888062e845317ba0e1da98a81c97b9288958cc71e8482ff829bf62e124c378b316c052baf359b6676299520dfbdae9ae2728d6702

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  75241375a32f913ff4424adf21d0aa89

                                                                                  SHA1

                                                                                  cf9d0d748e527902e9ddc31dc4a1ef501f0661be

                                                                                  SHA256

                                                                                  e478d6458214ef37d0028d5031436e9dd64ed86f9cbbf51b3a8b10d91ece277a

                                                                                  SHA512

                                                                                  96e527da26eb569359fc9e4888062e845317ba0e1da98a81c97b9288958cc71e8482ff829bf62e124c378b316c052baf359b6676299520dfbdae9ae2728d6702

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  6b7c5a1835ad6cbb1144072d114c628b

                                                                                  SHA1

                                                                                  46754f1ae29895760d23deb73f309da9b26f3fa9

                                                                                  SHA256

                                                                                  2fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f

                                                                                  SHA512

                                                                                  1eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  6b7c5a1835ad6cbb1144072d114c628b

                                                                                  SHA1

                                                                                  46754f1ae29895760d23deb73f309da9b26f3fa9

                                                                                  SHA256

                                                                                  2fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f

                                                                                  SHA512

                                                                                  1eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  6b7c5a1835ad6cbb1144072d114c628b

                                                                                  SHA1

                                                                                  46754f1ae29895760d23deb73f309da9b26f3fa9

                                                                                  SHA256

                                                                                  2fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f

                                                                                  SHA512

                                                                                  1eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  6b7c5a1835ad6cbb1144072d114c628b

                                                                                  SHA1

                                                                                  46754f1ae29895760d23deb73f309da9b26f3fa9

                                                                                  SHA256

                                                                                  2fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f

                                                                                  SHA512

                                                                                  1eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  6b7c5a1835ad6cbb1144072d114c628b

                                                                                  SHA1

                                                                                  46754f1ae29895760d23deb73f309da9b26f3fa9

                                                                                  SHA256

                                                                                  2fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f

                                                                                  SHA512

                                                                                  1eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  6b7c5a1835ad6cbb1144072d114c628b

                                                                                  SHA1

                                                                                  46754f1ae29895760d23deb73f309da9b26f3fa9

                                                                                  SHA256

                                                                                  2fb467d0298389d702a0572d10c99b727a5ecfd446a39bdd93fcb6e381c0396f

                                                                                  SHA512

                                                                                  1eec029c2a2a33afc4a6d6dba1c649564a94aefd607403e6abf60a8275250fdb527d1a04102289e27d0d7d039f31b2207230e7459c7fbd3701cbff504887345c

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  96f5eb9ce57272ff7959161b45c7171f

                                                                                  SHA1

                                                                                  489da0ed12141280540d30d23a655b788ec7b682

                                                                                  SHA256

                                                                                  2a33fbd065527acc09d3202ff407a76049be9820c8563f828209bdaedfaeefc9

                                                                                  SHA512

                                                                                  fca60814d20c380a54643c91e57b97d87778bd4d69864acbceb8e76b4da6d8f0331d262da9eea3c2b6b5628391fe1e259f0a5be45e33d701c17676951dbc6313

                                                                                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  96f5eb9ce57272ff7959161b45c7171f

                                                                                  SHA1

                                                                                  489da0ed12141280540d30d23a655b788ec7b682

                                                                                  SHA256

                                                                                  2a33fbd065527acc09d3202ff407a76049be9820c8563f828209bdaedfaeefc9

                                                                                  SHA512

                                                                                  fca60814d20c380a54643c91e57b97d87778bd4d69864acbceb8e76b4da6d8f0331d262da9eea3c2b6b5628391fe1e259f0a5be45e33d701c17676951dbc6313

                                                                                • C:\Program Files\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  2baeb27abedb9a7c571dda9bdf6cd506

                                                                                  SHA1

                                                                                  be2ef378085aa7214324c682a2dd1149f13c275a

                                                                                  SHA256

                                                                                  4d8dc2146e62840aa222753ca9617ac84f1025719573f9fd2f4a2c0a570d5357

                                                                                  SHA512

                                                                                  68efe345c470508d08789312aff34ba16c0ca4cd1b84aafd33b0df87b03fdba485ff1e858ce5e6355914d671c5f789b2e4b18cae2e44dad411556f44467ff31f

                                                                                • C:\Program Files\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  2baeb27abedb9a7c571dda9bdf6cd506

                                                                                  SHA1

                                                                                  be2ef378085aa7214324c682a2dd1149f13c275a

                                                                                  SHA256

                                                                                  4d8dc2146e62840aa222753ca9617ac84f1025719573f9fd2f4a2c0a570d5357

                                                                                  SHA512

                                                                                  68efe345c470508d08789312aff34ba16c0ca4cd1b84aafd33b0df87b03fdba485ff1e858ce5e6355914d671c5f789b2e4b18cae2e44dad411556f44467ff31f

                                                                                • C:\System Restore.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  f4e1ebb9e5726defc26b12631b37ede1

                                                                                  SHA1

                                                                                  31eb5bcc8c1f5ae8af6fc557d3c2610c78ea6a8c

                                                                                  SHA256

                                                                                  04946d73c418eda82028c5bc63a26316e0e1bb3d8e1b1c02acc1696028d8e890

                                                                                  SHA512

                                                                                  a7232a89192b68d1c664e37d3045ded800c4d40cef3e9e0d3b9778ce9d57b04f9c36b082edf934e47b4d8ffe79b5aafd15b268c1b7f6c8f0ba8e86e35f5e9a88

                                                                                • C:\System Restore.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  f4e1ebb9e5726defc26b12631b37ede1

                                                                                  SHA1

                                                                                  31eb5bcc8c1f5ae8af6fc557d3c2610c78ea6a8c

                                                                                  SHA256

                                                                                  04946d73c418eda82028c5bc63a26316e0e1bb3d8e1b1c02acc1696028d8e890

                                                                                  SHA512

                                                                                  a7232a89192b68d1c664e37d3045ded800c4d40cef3e9e0d3b9778ce9d57b04f9c36b082edf934e47b4d8ffe79b5aafd15b268c1b7f6c8f0ba8e86e35f5e9a88

                                                                                • C:\Users\Admin\AppData\Local\Temp\2210577132\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  0932b4d30effe0c2bddd2db011249d95

                                                                                  SHA1

                                                                                  02e6618b87aaa5dc0b60eff473983ed3506f3912

                                                                                  SHA256

                                                                                  3a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d

                                                                                  SHA512

                                                                                  a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2

                                                                                • C:\Users\Admin\AppData\Local\Temp\2210577132\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  0932b4d30effe0c2bddd2db011249d95

                                                                                  SHA1

                                                                                  02e6618b87aaa5dc0b60eff473983ed3506f3912

                                                                                  SHA256

                                                                                  3a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d

                                                                                  SHA512

                                                                                  a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2

                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  5cece52fc3b3296e1b0b6fa59245fcd6

                                                                                  SHA1

                                                                                  1a6664de9f9a037b079b6266ae4869413d4fcfe4

                                                                                  SHA256

                                                                                  e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08

                                                                                  SHA512

                                                                                  97c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d

                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  5cece52fc3b3296e1b0b6fa59245fcd6

                                                                                  SHA1

                                                                                  1a6664de9f9a037b079b6266ae4869413d4fcfe4

                                                                                  SHA256

                                                                                  e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08

                                                                                  SHA512

                                                                                  97c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d

                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  5cece52fc3b3296e1b0b6fa59245fcd6

                                                                                  SHA1

                                                                                  1a6664de9f9a037b079b6266ae4869413d4fcfe4

                                                                                  SHA256

                                                                                  e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08

                                                                                  SHA512

                                                                                  97c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d

                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  5cece52fc3b3296e1b0b6fa59245fcd6

                                                                                  SHA1

                                                                                  1a6664de9f9a037b079b6266ae4869413d4fcfe4

                                                                                  SHA256

                                                                                  e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08

                                                                                  SHA512

                                                                                  97c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d

                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  5cece52fc3b3296e1b0b6fa59245fcd6

                                                                                  SHA1

                                                                                  1a6664de9f9a037b079b6266ae4869413d4fcfe4

                                                                                  SHA256

                                                                                  e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08

                                                                                  SHA512

                                                                                  97c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d

                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  5cece52fc3b3296e1b0b6fa59245fcd6

                                                                                  SHA1

                                                                                  1a6664de9f9a037b079b6266ae4869413d4fcfe4

                                                                                  SHA256

                                                                                  e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08

                                                                                  SHA512

                                                                                  97c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d

                                                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  0932b4d30effe0c2bddd2db011249d95

                                                                                  SHA1

                                                                                  02e6618b87aaa5dc0b60eff473983ed3506f3912

                                                                                  SHA256

                                                                                  3a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d

                                                                                  SHA512

                                                                                  a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2

                                                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  0932b4d30effe0c2bddd2db011249d95

                                                                                  SHA1

                                                                                  02e6618b87aaa5dc0b60eff473983ed3506f3912

                                                                                  SHA256

                                                                                  3a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d

                                                                                  SHA512

                                                                                  a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2

                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  0932b4d30effe0c2bddd2db011249d95

                                                                                  SHA1

                                                                                  02e6618b87aaa5dc0b60eff473983ed3506f3912

                                                                                  SHA256

                                                                                  3a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d

                                                                                  SHA512

                                                                                  a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2

                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  0932b4d30effe0c2bddd2db011249d95

                                                                                  SHA1

                                                                                  02e6618b87aaa5dc0b60eff473983ed3506f3912

                                                                                  SHA256

                                                                                  3a767f8a5570d1bb248e2e1a3a6952b908f0052b49328b9a0a01e540d1dd9a5d

                                                                                  SHA512

                                                                                  a2c799a45b1f83180f6a0cebac193d881a97d4c9ad6f6bfec0c2fe6fbaa0e333ee9d8f0323509fa5e37f7f37d90874e651710b5eecca574e5a1b8ab41250a6a2

                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  5cece52fc3b3296e1b0b6fa59245fcd6

                                                                                  SHA1

                                                                                  1a6664de9f9a037b079b6266ae4869413d4fcfe4

                                                                                  SHA256

                                                                                  e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08

                                                                                  SHA512

                                                                                  97c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d

                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  5cece52fc3b3296e1b0b6fa59245fcd6

                                                                                  SHA1

                                                                                  1a6664de9f9a037b079b6266ae4869413d4fcfe4

                                                                                  SHA256

                                                                                  e282275aa23db1744f9844f14ff65e6bb2e41129387ff7c369be27cd37214b08

                                                                                  SHA512

                                                                                  97c3b42a1164735bcb15de148e4a59eec792f9430af84d28a74a3a4b8b0493f39186cd7d9d4a0a30d753774305d45df1d35bbf704fa30083f9ac33079886e09d

                                                                                • C:\odt\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  39c126d8aeecd852027804aa5dc4fb21

                                                                                  SHA1

                                                                                  549e466f358d4b63dca97f746197701507a7cd24

                                                                                  SHA256

                                                                                  f35815f4e76d53248a4f344e110d9f211d1f7684fdbd73f35cbf0bbbd4c58865

                                                                                  SHA512

                                                                                  64a7309c4d5ded03868b3a59089f241d130832d67292f0ad73d2254d3eb1e73fbb91a8642be7f8cf974930b9630a348f2d55b22ba57db8dc9730647e1816579f

                                                                                • C:\odt\backup.exe

                                                                                  Filesize

                                                                                  72KB

                                                                                  MD5

                                                                                  39c126d8aeecd852027804aa5dc4fb21

                                                                                  SHA1

                                                                                  549e466f358d4b63dca97f746197701507a7cd24

                                                                                  SHA256

                                                                                  f35815f4e76d53248a4f344e110d9f211d1f7684fdbd73f35cbf0bbbd4c58865

                                                                                  SHA512

                                                                                  64a7309c4d5ded03868b3a59089f241d130832d67292f0ad73d2254d3eb1e73fbb91a8642be7f8cf974930b9630a348f2d55b22ba57db8dc9730647e1816579f