Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    192s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 17:52

General

  • Target

    1d1446365df8d3980702b86f751f05d65a06ca1888a52e6f2d8cdfd2a7106c84.exe

  • Size

    72KB

  • MD5

    0fb74ad04b856dce3af22768a0df232d

  • SHA1

    4d2882341145cf4efca7fcad4bdef370a216b18f

  • SHA256

    1d1446365df8d3980702b86f751f05d65a06ca1888a52e6f2d8cdfd2a7106c84

  • SHA512

    8b87f243788b85bcbd9a48a98911df95be1cb9d4cfd0ba2a06693f0fa453c39eb411f5904b452025293732376fba678a538b069f810e39fd05124c30fb02b8f2

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2S:ipQNwC3BEddsEqOt/hyJF+x3BEJwRru

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d1446365df8d3980702b86f751f05d65a06ca1888a52e6f2d8cdfd2a7106c84.exe
    "C:\Users\Admin\AppData\Local\Temp\1d1446365df8d3980702b86f751f05d65a06ca1888a52e6f2d8cdfd2a7106c84.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1920
    • C:\Users\Admin\AppData\Local\Temp\3644261062\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3644261062\backup.exe C:\Users\Admin\AppData\Local\Temp\3644261062\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:204
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4708
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1948
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3048
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:752
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:808
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2176
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3216
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4964
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:2640
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1572
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:3460
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3484
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3700
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4360
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4348
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2592
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4856
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1204
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:5084
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                    PID:2560
                  • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:2120
                  • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                    8⤵
                      PID:1200
                    • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                      8⤵
                        PID:1468
                      • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                        8⤵
                        • System policy modification
                        PID:4848
                      • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                        8⤵
                          PID:4948
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                          8⤵
                          • Drops file in Program Files directory
                          • System policy modification
                          PID:3620
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                            9⤵
                              PID:4324
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                              9⤵
                                PID:2536
                              • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                                9⤵
                                  PID:3580
                                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                                  9⤵
                                    PID:3096
                                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                                    9⤵
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:2996
                                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\System Restore.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                                    9⤵
                                      PID:3684
                                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                                      9⤵
                                      • System policy modification
                                      PID:3152
                                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                                      9⤵
                                        PID:3484
                                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                                        9⤵
                                        • System policy modification
                                        PID:1772
                                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\update.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                                        9⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:2176
                                    • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                                      8⤵
                                        PID:320
                                      • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                                        8⤵
                                          PID:3920
                                        • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          PID:4912
                                        • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System policy modification
                                          PID:5092
                                        • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\update.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\update.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          PID:1324
                                        • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                                          8⤵
                                            PID:1356
                                          • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                                            8⤵
                                            • Disables RegEdit via registry modification
                                            PID:1468
                                          • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                                            8⤵
                                              PID:1384
                                            • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                                              8⤵
                                              • System policy modification
                                              PID:2776
                                            • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:1308
                                            • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                                              8⤵
                                                PID:1264
                                              • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System policy modification
                                                PID:4632
                                              • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                                                8⤵
                                                  PID:3456
                                                • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                                                  8⤵
                                                    PID:3452
                                                  • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                                                    8⤵
                                                      PID:3640
                                                    • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                                                      8⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:2292
                                                    • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                                                      8⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      PID:3840
                                                    • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                                                      8⤵
                                                        PID:3388
                                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                                      7⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:396
                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                                        8⤵
                                                          PID:1060
                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                                          8⤵
                                                            PID:5064
                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                                            8⤵
                                                            • Disables RegEdit via registry modification
                                                            PID:2860
                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                                            8⤵
                                                              PID:2704
                                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:4444
                                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System policy modification
                                                              PID:2292
                                                            • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                              "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                              8⤵
                                                              • System policy modification
                                                              PID:5044
                                                              • C:\Program Files\Mozilla Firefox\browser\VisualElements\System Restore.exe
                                                                "C:\Program Files\Mozilla Firefox\browser\VisualElements\System Restore.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
                                                                9⤵
                                                                  PID:2876
                                                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                                              7⤵
                                                                PID:5004
                                                                • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                                                  "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                                                  8⤵
                                                                    PID:4980
                                                                • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                                                  "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                                                  7⤵
                                                                    PID:2744
                                                                  • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                                                    "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                                                    7⤵
                                                                      PID:3048
                                                                      • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                                                        "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                                        8⤵
                                                                          PID:2664
                                                                      • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                                                        "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                                                        7⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:3960
                                                                      • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                                                        "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                                                        7⤵
                                                                          PID:1436
                                                                        • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                                                          "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                                                          7⤵
                                                                            PID:5076
                                                                            • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                                                              "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                                              8⤵
                                                                                PID:2792
                                                                          • C:\Program Files\Common Files\Services\backup.exe
                                                                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                                            6⤵
                                                                              PID:4080
                                                                            • C:\Program Files\Common Files\System\backup.exe
                                                                              "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                                              6⤵
                                                                              • Drops file in Program Files directory
                                                                              PID:2524
                                                                              • C:\Program Files\Common Files\System\de-DE\data.exe
                                                                                "C:\Program Files\Common Files\System\de-DE\data.exe" C:\Program Files\Common Files\System\de-DE\
                                                                                7⤵
                                                                                  PID:4512
                                                                                • C:\Program Files\Common Files\System\en-US\backup.exe
                                                                                  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                                                  7⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  PID:1532
                                                                                • C:\Program Files\Common Files\System\fr-FR\update.exe
                                                                                  "C:\Program Files\Common Files\System\fr-FR\update.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                                  7⤵
                                                                                  • System policy modification
                                                                                  PID:848
                                                                                • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                                                  "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                                                  7⤵
                                                                                    PID:4188
                                                                                  • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                                    "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                                    7⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • System policy modification
                                                                                    PID:3596
                                                                                  • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                                    "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                                    7⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:2496
                                                                                  • C:\Program Files\Common Files\System\msadc\backup.exe
                                                                                    "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                                                    7⤵
                                                                                      PID:1472
                                                                                • C:\Program Files\Google\backup.exe
                                                                                  "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                  5⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  • System policy modification
                                                                                  PID:4596
                                                                                  • C:\Program Files\Google\Chrome\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                                    6⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1392
                                                                                    • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                                      7⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      • System policy modification
                                                                                      PID:1260
                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                        8⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Program Files directory
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:2976
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4440
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2380
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1456
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:3036
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                          9⤵
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4888
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1432
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          • System policy modification
                                                                                          PID:5052
                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                          9⤵
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2956
                                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                            10⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1172
                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                              11⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1948
                                                                                      • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                        8⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • System policy modification
                                                                                        PID:2792
                                                                                • C:\Program Files\Internet Explorer\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                  5⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Program Files directory
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4408
                                                                                  • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                    "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                    6⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:3164
                                                                                  • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                    "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                    6⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2860
                                                                                  • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4356
                                                                                  • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4816
                                                                                  • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                    "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                    6⤵
                                                                                      PID:3436
                                                                                    • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                      "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                      6⤵
                                                                                      • System policy modification
                                                                                      PID:3360
                                                                                    • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                      "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                      6⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:4644
                                                                                    • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                      "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                      6⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:4352
                                                                                  • C:\Program Files\Java\backup.exe
                                                                                    "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                    5⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Drops file in Program Files directory
                                                                                    PID:4828
                                                                                    • C:\Program Files\Java\jdk1.8.0_66\update.exe
                                                                                      "C:\Program Files\Java\jdk1.8.0_66\update.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                      6⤵
                                                                                      • System policy modification
                                                                                      PID:3848
                                                                                      • C:\Program Files\Java\jdk1.8.0_66\bin\data.exe
                                                                                        "C:\Program Files\Java\jdk1.8.0_66\bin\data.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                        7⤵
                                                                                          PID:4232
                                                                                        • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                          "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                          7⤵
                                                                                          • Drops file in Program Files directory
                                                                                          PID:4292
                                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                            8⤵
                                                                                            • System policy modification
                                                                                            PID:4812
                                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                            8⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:1712
                                                                                        • C:\Program Files\Java\jdk1.8.0_66\include\System Restore.exe
                                                                                          "C:\Program Files\Java\jdk1.8.0_66\include\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                          7⤵
                                                                                          • System policy modification
                                                                                          PID:2264
                                                                                          • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                            "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                            8⤵
                                                                                              PID:3164
                                                                                              • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                9⤵
                                                                                                  PID:3024
                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                              7⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:4188
                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                                8⤵
                                                                                                • Drops file in Program Files directory
                                                                                                PID:3468
                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\System Restore.exe
                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\
                                                                                                  9⤵
                                                                                                    PID:1804
                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe
                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\
                                                                                                    9⤵
                                                                                                      PID:2584
                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\data.exe
                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\data.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\
                                                                                                      9⤵
                                                                                                        PID:1000
                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\backup.exe
                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\
                                                                                                        9⤵
                                                                                                          PID:4504
                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\data.exe
                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\data.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\
                                                                                                          9⤵
                                                                                                            PID:2088
                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe
                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\
                                                                                                            9⤵
                                                                                                              PID:4472
                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe
                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\
                                                                                                                10⤵
                                                                                                                  PID:4396
                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\
                                                                                                                  10⤵
                                                                                                                  • System policy modification
                                                                                                                  PID:3484
                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\update.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\
                                                                                                                  10⤵
                                                                                                                    PID:4168
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\
                                                                                                                  9⤵
                                                                                                                  • System policy modification
                                                                                                                  PID:2116
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\
                                                                                                                  9⤵
                                                                                                                  • System policy modification
                                                                                                                  PID:1448
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                                8⤵
                                                                                                                  PID:4512
                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\data.exe
                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\lib\data.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                                                                7⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:3540
                                                                                                            • C:\Program Files\Java\jre1.8.0_66\update.exe
                                                                                                              "C:\Program Files\Java\jre1.8.0_66\update.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                              6⤵
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:5104
                                                                                                              • C:\Program Files\Java\jre1.8.0_66\lib\backup.exe
                                                                                                                "C:\Program Files\Java\jre1.8.0_66\lib\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\
                                                                                                                7⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:3704
                                                                                                                • C:\Program Files\Java\jre1.8.0_66\lib\amd64\update.exe
                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\lib\amd64\update.exe" C:\Program Files\Java\jre1.8.0_66\lib\amd64\
                                                                                                                  8⤵
                                                                                                                  • System policy modification
                                                                                                                  PID:3068
                                                                                                                • C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe
                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\applet\
                                                                                                                  8⤵
                                                                                                                    PID:3728
                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe
                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\cmm\
                                                                                                                    8⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:3288
                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\images\backup.exe
                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\images\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\images\
                                                                                                                    8⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:4708
                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\backup.exe
                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\
                                                                                                                      9⤵
                                                                                                                        PID:3436
                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe
                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\fonts\
                                                                                                                      8⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      PID:4508
                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\lib\ext\update.exe
                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\lib\ext\update.exe" C:\Program Files\Java\jre1.8.0_66\lib\ext\
                                                                                                                      8⤵
                                                                                                                        PID:2760
                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe
                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\deploy\
                                                                                                                        8⤵
                                                                                                                          PID:3112
                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\lib\jfr\backup.exe
                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\lib\jfr\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\jfr\
                                                                                                                          8⤵
                                                                                                                            PID:4980
                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\lib\management\backup.exe
                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\lib\management\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\management\
                                                                                                                            8⤵
                                                                                                                            • System policy modification
                                                                                                                            PID:2928
                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\lib\security\backup.exe
                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\lib\security\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\security\
                                                                                                                            8⤵
                                                                                                                              PID:1600
                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                                            7⤵
                                                                                                                              PID:2276
                                                                                                                        • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                          "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                          5⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          PID:2268
                                                                                                                          • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                                            "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                            6⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • System policy modification
                                                                                                                            PID:4436
                                                                                                                          • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                                            "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                            6⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            PID:2492
                                                                                                                          • C:\Program Files\Microsoft Office\root\update.exe
                                                                                                                            "C:\Program Files\Microsoft Office\root\update.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                            6⤵
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:5116
                                                                                                                            • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                                              "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                                              7⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:4304
                                                                                                                              • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                                                                                "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                                                                                8⤵
                                                                                                                                  PID:3800
                                                                                                                                • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
                                                                                                                                  "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
                                                                                                                                  8⤵
                                                                                                                                    PID:1656
                                                                                                                                  • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\System Restore.exe
                                                                                                                                    "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\System Restore.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                                    8⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • System policy modification
                                                                                                                                    PID:1272
                                                                                                                                • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                                                                  "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                                                  7⤵
                                                                                                                                    PID:3096
                                                                                                                                  • C:\Program Files\Microsoft Office\root\fre\backup.exe
                                                                                                                                    "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
                                                                                                                                    7⤵
                                                                                                                                      PID:1436
                                                                                                                                    • C:\Program Files\Microsoft Office\root\Integration\System Restore.exe
                                                                                                                                      "C:\Program Files\Microsoft Office\root\Integration\System Restore.exe" C:\Program Files\Microsoft Office\root\Integration\
                                                                                                                                      7⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      PID:3372
                                                                                                                                      • C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe
                                                                                                                                        "C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\
                                                                                                                                        8⤵
                                                                                                                                          PID:2272
                                                                                                                                      • C:\Program Files\Microsoft Office\root\loc\backup.exe
                                                                                                                                        "C:\Program Files\Microsoft Office\root\loc\backup.exe" C:\Program Files\Microsoft Office\root\loc\
                                                                                                                                        7⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        PID:1624
                                                                                                                                      • C:\Program Files\Microsoft Office\root\Office15\update.exe
                                                                                                                                        "C:\Program Files\Microsoft Office\root\Office15\update.exe" C:\Program Files\Microsoft Office\root\Office15\
                                                                                                                                        7⤵
                                                                                                                                          PID:4376
                                                                                                                                        • C:\Program Files\Microsoft Office\root\Office16\backup.exe
                                                                                                                                          "C:\Program Files\Microsoft Office\root\Office16\backup.exe" C:\Program Files\Microsoft Office\root\Office16\
                                                                                                                                          7⤵
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:1920
                                                                                                                                          • C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe
                                                                                                                                            "C:\Program Files\Microsoft Office\root\Office16\1033\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\
                                                                                                                                            8⤵
                                                                                                                                              PID:4212
                                                                                                                                              • C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe
                                                                                                                                                "C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\
                                                                                                                                                9⤵
                                                                                                                                                  PID:2740
                                                                                                                                                • C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe
                                                                                                                                                  "C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\backup.exe" C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\
                                                                                                                                                  9⤵
                                                                                                                                                    PID:3892
                                                                                                                                              • C:\Program Files\Microsoft Office\root\Licenses16\backup.exe
                                                                                                                                                "C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\
                                                                                                                                                7⤵
                                                                                                                                                  PID:376
                                                                                                                                                • C:\Program Files\Microsoft Office\root\Licenses\backup.exe
                                                                                                                                                  "C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\
                                                                                                                                                  7⤵
                                                                                                                                                    PID:728
                                                                                                                                                • C:\Program Files\Microsoft Office\Updates\backup.exe
                                                                                                                                                  "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
                                                                                                                                                  6⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  PID:1620
                                                                                                                                                  • C:\Program Files\Microsoft Office\Updates\Download\backup.exe
                                                                                                                                                    "C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\
                                                                                                                                                    7⤵
                                                                                                                                                      PID:2532
                                                                                                                                                    • C:\Program Files\Microsoft Office\Updates\Apply\backup.exe
                                                                                                                                                      "C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\
                                                                                                                                                      7⤵
                                                                                                                                                        PID:2792
                                                                                                                                                  • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                                                                    "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                                                                    5⤵
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    PID:3120
                                                                                                                                                    • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                                                                                                      "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                                                                                      6⤵
                                                                                                                                                        PID:1916
                                                                                                                                                    • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                                                                      "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                                                                      5⤵
                                                                                                                                                        PID:396
                                                                                                                                                        • C:\Program Files\Mozilla Firefox\defaults\backup.exe
                                                                                                                                                          "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
                                                                                                                                                          6⤵
                                                                                                                                                          • System policy modification
                                                                                                                                                          PID:2416
                                                                                                                                                          • C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe
                                                                                                                                                            "C:\Program Files\Mozilla Firefox\defaults\pref\backup.exe" C:\Program Files\Mozilla Firefox\defaults\pref\
                                                                                                                                                            7⤵
                                                                                                                                                              PID:3936
                                                                                                                                                      • C:\Program Files (x86)\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:4288
                                                                                                                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                                                          5⤵
                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:1236
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                                                            6⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:4764
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                                                              7⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:3208
                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                                                              7⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:1560
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                                                8⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:4536
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                                                  9⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:5032
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                                                8⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:4804
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                                                  9⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:2996
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                                                8⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:2360
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                                                8⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:5060
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                                                8⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:364
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                                                  9⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:2096
                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                                                8⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:4632
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:2516
                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:1508
                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                                                    8⤵
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:4380
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:5008
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                                                      8⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      PID:3348
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                                        9⤵
                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                        PID:772
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                                                      8⤵
                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      PID:3700
                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:728
                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                                            10⤵
                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                            PID:2876
                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:2388
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                                              10⤵
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                              PID:4336
                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                                                11⤵
                                                                                                                                                                                  PID:5060
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                                                                                                              9⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                              PID:4652
                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                                                                10⤵
                                                                                                                                                                                  PID:3436
                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                                                                                                                9⤵
                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                PID:4588
                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:4004
                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\data.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                                                                                  9⤵
                                                                                                                                                                                    PID:808
                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:4140
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:3504
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:2200
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:3960
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                                                          8⤵
                                                                                                                                                                                            PID:5016
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                                                              9⤵
                                                                                                                                                                                                PID:528
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:1828
                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                PID:868
                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                    PID:3536
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                      PID:2392
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\data.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                      PID:2208
                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\data.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                        PID:4968
                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\System Restore.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                          PID:2100
                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                          PID:3740
                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:3052
                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:2232
                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\update.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\update.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:3472
                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                      PID:4844
                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:228
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\data.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                    PID:4524
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                        PID:4212
                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                          PID:3092
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                    PID:3520
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Java\update.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Java\update.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                  PID:1984
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                    PID:1012
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                      PID:4872
                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                      PID:5040
                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                        PID:1736
                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\data.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                            PID:4836
                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\
                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                              PID:4024
                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\
                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\
                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                  PID:1868
                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                    PID:4360
                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\update.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:1000
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                    PID:1908
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                      PID:4992
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                    PID:864
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                      PID:2996
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                        PID:808
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\data.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:3036
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                          PID:4896
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                          PID:3448
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\Policies\update.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\Policies\update.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                            PID:2536
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            PID:1460
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                              PID:4388
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\backup.exe" C:\Program Files (x86)\Google\Update\Install\{4CA8DFAB-80A0-43FC-AC78-FBACDED770CF}\
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Google\Update\Offline\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Google\Update\Offline\backup.exe" C:\Program Files (x86)\Google\Update\Offline\
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:2792
                                                                                                                                                                                                                                                  • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\update.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\update.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                      PID:3292
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:1832
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\images\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:376
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\it-IT\backup.exe" C:\Program Files (x86)\Internet Explorer\it-IT\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                        PID:1612
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:1608
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:2564
                                                                                                                                                                                                                                                      • C:\Users\backup.exe
                                                                                                                                                                                                                                                        C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                                                        • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:1616
                                                                                                                                                                                                                                                          • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                          • C:\Users\Admin\Contacts\System Restore.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\Contacts\System Restore.exe" C:\Users\Admin\Contacts\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:3912
                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                            PID:4312
                                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:2152
                                                                                                                                                                                                                                                            • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:540
                                                                                                                                                                                                                                                              • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:1384
                                                                                                                                                                                                                                                                • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                  • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:1128
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                      PID:1004
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                        PID:2788
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                          PID:2384
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                        PID:1436
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:656
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Videos\System Restore.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Videos\System Restore.exe" C:\Users\Admin\Videos\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:4428
                                                                                                                                                                                                                                                                        • C:\Users\Public\backup.exe
                                                                                                                                                                                                                                                                          C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                              PID:700
                                                                                                                                                                                                                                                                            • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                              PID:4852
                                                                                                                                                                                                                                                                            • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                              • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                                                                                                C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:5020
                                                                                                                                                                                                                                                                                • C:\Users\Public\Downloads\System Restore.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Public\Downloads\System Restore.exe" C:\Users\Public\Downloads\
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:2908
                                                                                                                                                                                                                                                                              • C:\Windows\backup.exe
                                                                                                                                                                                                                                                                                C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:4808
                                                                                                                                                                                                                                                                                • C:\Windows\appcompat\data.exe
                                                                                                                                                                                                                                                                                  C:\Windows\appcompat\data.exe C:\Windows\appcompat\
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                                                  • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:4060
                                                                                                                                                                                                                                                                                    • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                                                                                                                                      C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                        PID:2876
                                                                                                                                                                                                                                                                                    • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                                                                                                      C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:2560
                                                                                                                                                                                                                                                                                      • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                                                                                                        C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                                                                      • C:\Windows\apppatch\update.exe
                                                                                                                                                                                                                                                                                        C:\Windows\apppatch\update.exe C:\Windows\apppatch\
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:3396
                                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                                                                                                                                                                          C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                          PID:3668
                                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                                                                                                                                                                          C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:5020
                                                                                                                                                                                                                                                                                          • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                                                                                                                                                                            C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                            PID:4052
                                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                                                                                                                                                                                          C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                          PID:1976
                                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\es-ES\backup.exe
                                                                                                                                                                                                                                                                                          C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                          PID:3016
                                                                                                                                                                                                                                                                                        • C:\Windows\apppatch\en-US\backup.exe
                                                                                                                                                                                                                                                                                          C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                                                                                                          • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                                                                                                                                                                                            C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:4760
                                                                                                                                                                                                                                                                                            • C:\Windows\apppatch\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                              C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                              PID:1484
                                                                                                                                                                                                                                                                                            • C:\Windows\apppatch\it-IT\backup.exe
                                                                                                                                                                                                                                                                                              C:\Windows\apppatch\it-IT\backup.exe C:\Windows\apppatch\it-IT\
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                              PID:1516
                                                                                                                                                                                                                                                                                            • C:\Windows\apppatch\ja-JP\backup.exe
                                                                                                                                                                                                                                                                                              C:\Windows\apppatch\ja-JP\backup.exe C:\Windows\apppatch\ja-JP\
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                              PID:4012
                                                                                                                                                                                                                                                                                          • C:\Windows\addins\backup.exe
                                                                                                                                                                                                                                                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                            PID:4604
                                                                                                                                                                                                                                                                                          • C:\Windows\assembly\backup.exe
                                                                                                                                                                                                                                                                                            C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:3708
                                                                                                                                                                                                                                                                                          • C:\Windows\AppReadiness\backup.exe
                                                                                                                                                                                                                                                                                            C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                            PID:504
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:3668
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:4652
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:3740
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:3596
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:4580
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:4260
                                                                                                                                                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                                  • C:\Program Files\Common Files\System\ado\backup.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:4232
                                                                                                                                                                                                                                                                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:3196
                                                                                                                                                                                                                                                                                      • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                        • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:4296
                                                                                                                                                                                                                                                                                          • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:4084
                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                              PID:2500
                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                              PID:2204
                                                                                                                                                                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                            PID:1976
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:2532
                                                                                                                                                                                                                                                                                              • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                PID:1380
                                                                                                                                                                                                                                                                                                • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\root\System Restore.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\root\System Restore.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\root\
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                      PID:4076
                                                                                                                                                                                                                                                                                                      • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\root\vfs\backup.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\root\vfs\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\root\vfs\
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:5028
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                                  PID:3756
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                        PID:1412
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                          PID:3432
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:2860
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\update.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:4336
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                PID:2112
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\data.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                                                  PID:1344
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                    PID:3200
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                                PID:4940
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\System Restore.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                              PID:2092
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:660
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                  PID:4072
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\data.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:4976
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:3124
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\update.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\update.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                      PID:900
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\update.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\update.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:2320
                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:1716
                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                        PID:1516
                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                        PID:5052
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                        PID:1936
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:1556
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                          PID:728
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:4760
                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:4024
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                PID:256
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:772
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:3808
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                    PID:3912
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:928
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                        PID:4528
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\data.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\data.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:2616
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                            PID:1128
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:2460
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:4252
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4272
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\assembly\GAC\ADODB\backup.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:2152
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3104
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\System\ado\en-US\update.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\System\ado\en-US\update.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                  PID:3164
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\backup.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    PID:4088
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\assembly\GAC\Extensibility\backup.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:896
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1984
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:3908
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                                                      PID:4972
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\backup.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B11EF506-7DE1-455F-8E20-67264DD4AF60\
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1236
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                        PID:3232
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\System\ado\backup.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2036
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\System\ado\es-ES\backup.exe" C:\Program Files (x86)\Common Files\System\ado\es-ES\
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1428
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\System\ado\fr-FR\
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\System\ado\it-IT\backup.exe" C:\Program Files (x86)\Common Files\System\ado\it-IT\
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5092
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              PID:3508
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1448
                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\System Restore.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                PID:3672

                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                              • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                252da02c100eff3d86d9181ff7b7d6d5

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                2408de96052eb94a501d426ce623638e15f50f3e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                fa8ca16911aa00caff95ffbc5b5226e5f4ea863322b6a76947a84f4eb8431198

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                b49202bf944691c2ae490d5c7b9eb1af35241852711955cf5d592a90a6533469ef1f86c5a21d3ac30206eec953509383615eae89f3f71d7759ef6eed369ebd70

                                                                                                                                                                                                                                                                                                                                                              • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                252da02c100eff3d86d9181ff7b7d6d5

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                2408de96052eb94a501d426ce623638e15f50f3e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                fa8ca16911aa00caff95ffbc5b5226e5f4ea863322b6a76947a84f4eb8431198

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                b49202bf944691c2ae490d5c7b9eb1af35241852711955cf5d592a90a6533469ef1f86c5a21d3ac30206eec953509383615eae89f3f71d7759ef6eed369ebd70

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7d6906f41c329b5f7938c30f21788e00

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                f8cf6b63f81604f26605d84b26455bc15e5ea7bf

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                20ac90ec1d9e0e49532faf3564454f287825c11964687b992cba82472c5788e6

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                414cb95bb80b8ed439b7ddd93808f34346dee014e5f46b8a2e8bc8d1c261489013011cc2b147791be2473885097dac90db3ae559c3b66ad65361b74b890e712c

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7d6906f41c329b5f7938c30f21788e00

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                f8cf6b63f81604f26605d84b26455bc15e5ea7bf

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                20ac90ec1d9e0e49532faf3564454f287825c11964687b992cba82472c5788e6

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                414cb95bb80b8ed439b7ddd93808f34346dee014e5f46b8a2e8bc8d1c261489013011cc2b147791be2473885097dac90db3ae559c3b66ad65361b74b890e712c

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                59a408b377c928296947b1a977ce9844

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                707f0d5f080af071868fb1fb29a7ebd55edb499f

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                0748f5adcef4e79f8a5aa67312ff7042ae5144bc483dcfc1cd742cac697eda7c

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                c192cf8e785583543367adf04acb27887c6e58b6581e24cddc9d917412c11327d06cb7365a2172c13aee6809f5dd1f9287f53087d087e8343d3bfdcae0e64e14

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                59a408b377c928296947b1a977ce9844

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                707f0d5f080af071868fb1fb29a7ebd55edb499f

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                0748f5adcef4e79f8a5aa67312ff7042ae5144bc483dcfc1cd742cac697eda7c

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                c192cf8e785583543367adf04acb27887c6e58b6581e24cddc9d917412c11327d06cb7365a2172c13aee6809f5dd1f9287f53087d087e8343d3bfdcae0e64e14

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7d6906f41c329b5f7938c30f21788e00

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                f8cf6b63f81604f26605d84b26455bc15e5ea7bf

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                20ac90ec1d9e0e49532faf3564454f287825c11964687b992cba82472c5788e6

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                414cb95bb80b8ed439b7ddd93808f34346dee014e5f46b8a2e8bc8d1c261489013011cc2b147791be2473885097dac90db3ae559c3b66ad65361b74b890e712c

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7d6906f41c329b5f7938c30f21788e00

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                f8cf6b63f81604f26605d84b26455bc15e5ea7bf

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                20ac90ec1d9e0e49532faf3564454f287825c11964687b992cba82472c5788e6

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                414cb95bb80b8ed439b7ddd93808f34346dee014e5f46b8a2e8bc8d1c261489013011cc2b147791be2473885097dac90db3ae559c3b66ad65361b74b890e712c

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                e93aeabd5edc36312132a7e1dae8b7f9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                adf6d768ce31188c2df578d494f3ecc6a66e0ef2

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                d4d5626cbc6e22be741b370929e01e607eb44e52e657e3b02bba918e5f503aed

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                513f9b79f9f2f2f5f843c09f8f08ed6cbf64cba72ca7b7696575307e90da863b46f696c0136f8e5ebe96217aca1b8ac2adc3c68cdd6e3a68e911843efebfa524

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                e93aeabd5edc36312132a7e1dae8b7f9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                adf6d768ce31188c2df578d494f3ecc6a66e0ef2

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                d4d5626cbc6e22be741b370929e01e607eb44e52e657e3b02bba918e5f503aed

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                513f9b79f9f2f2f5f843c09f8f08ed6cbf64cba72ca7b7696575307e90da863b46f696c0136f8e5ebe96217aca1b8ac2adc3c68cdd6e3a68e911843efebfa524

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                8decdc61b74456dd403a1fe8c528514b

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                970ca4fa122609c560550274935cce0ff01fc821

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                28a1548d90b66f08420c462c89ecebc3c60271318894484fd67b1bdcd4ecfb9f

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                615d5e5a3b3d547c7c04ddbf289e9023e2c1d370883da8f78f64ce36ae88403bcd778999c543ed644e67bc109534dac951fef6de91e0696d63233e84f8a80fdf

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                8decdc61b74456dd403a1fe8c528514b

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                970ca4fa122609c560550274935cce0ff01fc821

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                28a1548d90b66f08420c462c89ecebc3c60271318894484fd67b1bdcd4ecfb9f

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                615d5e5a3b3d547c7c04ddbf289e9023e2c1d370883da8f78f64ce36ae88403bcd778999c543ed644e67bc109534dac951fef6de91e0696d63233e84f8a80fdf

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                559978be1d6133bba3c9fc434469bb97

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                23c148a8b57c5497ec2a83cc26ec5b135e7e4b3f

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                bc06596ea7fe21b8d5439439d7b0cbca99cc016caff9027fbf432a0e64187205

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                08d792d6d07951d07be2fab1103467399120d68df69239928a4f6fae14a94d94604650724ed427c9798f2cb927d728034a9726d8605627681fd4ec231879254f

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                559978be1d6133bba3c9fc434469bb97

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                23c148a8b57c5497ec2a83cc26ec5b135e7e4b3f

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                bc06596ea7fe21b8d5439439d7b0cbca99cc016caff9027fbf432a0e64187205

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                08d792d6d07951d07be2fab1103467399120d68df69239928a4f6fae14a94d94604650724ed427c9798f2cb927d728034a9726d8605627681fd4ec231879254f

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                2eec401c674da8eafab0a92df83e8c7c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a6c2f06618da64381c892168d6e90fcdc50043da

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                2ca5d2a9536fb1e0092bdb148d0d9c8d6d50107a0eb39ee686441263cf975107

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                54a330092601728b6fd91fbe8f510662cec5b3cbbfa402901a944fe331fe7b6cf69f6c880edef5e10e19985f6f1d30df2979164024b76f20fbd39363520594a7

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                2eec401c674da8eafab0a92df83e8c7c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a6c2f06618da64381c892168d6e90fcdc50043da

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                2ca5d2a9536fb1e0092bdb148d0d9c8d6d50107a0eb39ee686441263cf975107

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                54a330092601728b6fd91fbe8f510662cec5b3cbbfa402901a944fe331fe7b6cf69f6c880edef5e10e19985f6f1d30df2979164024b76f20fbd39363520594a7

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7b06b6f6f4c5865a9933e65864dbeab9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                5520ef033729cd6ae9bba633afbe5e9f62c8e892

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                0e7c9667989eda78ae5e7c063d8abecef0a4a1b521e118d9ff04f523f07b93c0

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                a5400f9a5711771b0a865fd75e7fb0f3cfd3a848db98e59d9112c48225ef90243606e8bc21b7bae2bc26265a0c6c624f832e87b5381608617c3a02412cddbb02

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7b06b6f6f4c5865a9933e65864dbeab9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                5520ef033729cd6ae9bba633afbe5e9f62c8e892

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                0e7c9667989eda78ae5e7c063d8abecef0a4a1b521e118d9ff04f523f07b93c0

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                a5400f9a5711771b0a865fd75e7fb0f3cfd3a848db98e59d9112c48225ef90243606e8bc21b7bae2bc26265a0c6c624f832e87b5381608617c3a02412cddbb02

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                3f973e8e56dcae41dec7a2712ef24c8f

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                252da765d62d51b1c5799952051e9289a6b86d69

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                8beec807b7c65b4af168c4d596374b22de3953cd185e7f2e1ff864d63f28a9ef

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                b70fb0687d8d8c9ec2d60570f54fae44924a58e3d6fd0d0614a704042a3144f5176adb32f25da89b22189dfd6e287fe9652f9988be5f0a15b748b203a21254b8

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                3f973e8e56dcae41dec7a2712ef24c8f

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                252da765d62d51b1c5799952051e9289a6b86d69

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                8beec807b7c65b4af168c4d596374b22de3953cd185e7f2e1ff864d63f28a9ef

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                b70fb0687d8d8c9ec2d60570f54fae44924a58e3d6fd0d0614a704042a3144f5176adb32f25da89b22189dfd6e287fe9652f9988be5f0a15b748b203a21254b8

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7b06b6f6f4c5865a9933e65864dbeab9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                5520ef033729cd6ae9bba633afbe5e9f62c8e892

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                0e7c9667989eda78ae5e7c063d8abecef0a4a1b521e118d9ff04f523f07b93c0

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                a5400f9a5711771b0a865fd75e7fb0f3cfd3a848db98e59d9112c48225ef90243606e8bc21b7bae2bc26265a0c6c624f832e87b5381608617c3a02412cddbb02

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7b06b6f6f4c5865a9933e65864dbeab9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                5520ef033729cd6ae9bba633afbe5e9f62c8e892

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                0e7c9667989eda78ae5e7c063d8abecef0a4a1b521e118d9ff04f523f07b93c0

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                a5400f9a5711771b0a865fd75e7fb0f3cfd3a848db98e59d9112c48225ef90243606e8bc21b7bae2bc26265a0c6c624f832e87b5381608617c3a02412cddbb02

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                bba96af944a2bbbb4969a4a3bd53e17c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                1574724d16455b505e49461bf89f70620a93bb17

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                319cef7423ca4de27985d74cb0e8b606a5aa0a554d6d1e268dc17c4c865ae063

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                8cc006f3a88f052a82eaa24e13f1c541ba787cfbbc38af34f8265c1fe5e16f46ea2696b7c5a1b725e7342c6f65087678bfd812ee6ce906031a2297596e3c2d63

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                bba96af944a2bbbb4969a4a3bd53e17c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                1574724d16455b505e49461bf89f70620a93bb17

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                319cef7423ca4de27985d74cb0e8b606a5aa0a554d6d1e268dc17c4c865ae063

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                8cc006f3a88f052a82eaa24e13f1c541ba787cfbbc38af34f8265c1fe5e16f46ea2696b7c5a1b725e7342c6f65087678bfd812ee6ce906031a2297596e3c2d63

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                f1af4c59d7cae6f239fad5fe5ad4067e

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                18f7fecbe09a2e4d0c979bf74a21caef15fa0d35

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                d69f3a8dbf3dc4ca8b17bb96e92045cec63567b3f066f787649d6b1326bfced3

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                8009f17e73af2ccf45a7bdd47c6d033ffd8806cd6880830b5de5b582898b99e93406062add6d68f50e931fb5555f918165e4ee5f20afaa9f2d1c087dfb1added

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                f1af4c59d7cae6f239fad5fe5ad4067e

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                18f7fecbe09a2e4d0c979bf74a21caef15fa0d35

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                d69f3a8dbf3dc4ca8b17bb96e92045cec63567b3f066f787649d6b1326bfced3

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                8009f17e73af2ccf45a7bdd47c6d033ffd8806cd6880830b5de5b582898b99e93406062add6d68f50e931fb5555f918165e4ee5f20afaa9f2d1c087dfb1added

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                627e452550d95041b1786f41a5455a8c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                0fdb189ca0e60fb0c0dc96d2d3d1e6a6b44eb1de

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e203cbbf9d0c2a9e461e8826385412b563373c3d3dfbe6892ceba6fb675752d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                5ea8c7bfd5bb92144e82da953d2b39053eb2a85a21b533b8c024fdd3fb11588d08b43603c1f465babc9d1c94a635abce3e9ed25db723dd4711903186d9c52d12

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                627e452550d95041b1786f41a5455a8c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                0fdb189ca0e60fb0c0dc96d2d3d1e6a6b44eb1de

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e203cbbf9d0c2a9e461e8826385412b563373c3d3dfbe6892ceba6fb675752d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                5ea8c7bfd5bb92144e82da953d2b39053eb2a85a21b533b8c024fdd3fb11588d08b43603c1f465babc9d1c94a635abce3e9ed25db723dd4711903186d9c52d12

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                bba96af944a2bbbb4969a4a3bd53e17c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                1574724d16455b505e49461bf89f70620a93bb17

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                319cef7423ca4de27985d74cb0e8b606a5aa0a554d6d1e268dc17c4c865ae063

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                8cc006f3a88f052a82eaa24e13f1c541ba787cfbbc38af34f8265c1fe5e16f46ea2696b7c5a1b725e7342c6f65087678bfd812ee6ce906031a2297596e3c2d63

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                bba96af944a2bbbb4969a4a3bd53e17c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                1574724d16455b505e49461bf89f70620a93bb17

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                319cef7423ca4de27985d74cb0e8b606a5aa0a554d6d1e268dc17c4c865ae063

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                8cc006f3a88f052a82eaa24e13f1c541ba787cfbbc38af34f8265c1fe5e16f46ea2696b7c5a1b725e7342c6f65087678bfd812ee6ce906031a2297596e3c2d63

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                cab6ae205d66bf21bf76feb6a2d20e6c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a872b618790bc1a334cc61dc69ffb828b27bd16e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                7a59aceb0a39f04c3a25283874e9ea7d6c4e1adfc6e1d7e1081450f149f95969

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                7a69cd22d9b28fd3ba12f812e958a65ec6b069b2f9630493c28aee205e17792294677adaf16e473b8f9b5bd936a61b503cb18478cb403b4d70c782386336bc36

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                cab6ae205d66bf21bf76feb6a2d20e6c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a872b618790bc1a334cc61dc69ffb828b27bd16e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                7a59aceb0a39f04c3a25283874e9ea7d6c4e1adfc6e1d7e1081450f149f95969

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                7a69cd22d9b28fd3ba12f812e958a65ec6b069b2f9630493c28aee205e17792294677adaf16e473b8f9b5bd936a61b503cb18478cb403b4d70c782386336bc36

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                9c39c3453d5c9a08b2cd2c80dfdd0b8f

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                822fb9a2ecb5e39e91d13d88950c9435d8d16b9e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                dd20dfadd8f988366b617886a9efa8bd2c40052d99eba1caba0d1dd03a156958

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                385922560aee88632a11de941f53fe6009e5f2d00b6fef7e6c705ae50abb776ef3e2d025c5134dc9dcdc37c2b8eb55b08649b754ba477e70871f2c60187dc5ff

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                9c39c3453d5c9a08b2cd2c80dfdd0b8f

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                822fb9a2ecb5e39e91d13d88950c9435d8d16b9e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                dd20dfadd8f988366b617886a9efa8bd2c40052d99eba1caba0d1dd03a156958

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                385922560aee88632a11de941f53fe6009e5f2d00b6fef7e6c705ae50abb776ef3e2d025c5134dc9dcdc37c2b8eb55b08649b754ba477e70871f2c60187dc5ff

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                608c372c823588fab0286f8b31eae350

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                345e15596832c7cae0bea37147f96d932f4fbb85

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                af339d45d77369d662f9f20be4b74e9d694b1d03da8b75556b33399f4b989834

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                7a06d5a2ab8ed4c09ba9d2bea4f534fe15556c4294fb9b81bd788ee688db7a159175d5b5c76520d9c55804a0b76ed36ba25984b160ae3418a8e24cea8636a76a

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                608c372c823588fab0286f8b31eae350

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                345e15596832c7cae0bea37147f96d932f4fbb85

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                af339d45d77369d662f9f20be4b74e9d694b1d03da8b75556b33399f4b989834

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                7a06d5a2ab8ed4c09ba9d2bea4f534fe15556c4294fb9b81bd788ee688db7a159175d5b5c76520d9c55804a0b76ed36ba25984b160ae3418a8e24cea8636a76a

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                9c39c3453d5c9a08b2cd2c80dfdd0b8f

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                822fb9a2ecb5e39e91d13d88950c9435d8d16b9e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                dd20dfadd8f988366b617886a9efa8bd2c40052d99eba1caba0d1dd03a156958

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                385922560aee88632a11de941f53fe6009e5f2d00b6fef7e6c705ae50abb776ef3e2d025c5134dc9dcdc37c2b8eb55b08649b754ba477e70871f2c60187dc5ff

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                9c39c3453d5c9a08b2cd2c80dfdd0b8f

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                822fb9a2ecb5e39e91d13d88950c9435d8d16b9e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                dd20dfadd8f988366b617886a9efa8bd2c40052d99eba1caba0d1dd03a156958

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                385922560aee88632a11de941f53fe6009e5f2d00b6fef7e6c705ae50abb776ef3e2d025c5134dc9dcdc37c2b8eb55b08649b754ba477e70871f2c60187dc5ff

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                eeb0177d1c9b4553500c8220c52ac0bf

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                5c861107bef62e19833c1cbade44ef167a18e5c4

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                02230518759fd692790aaca2cf0b337cd4652f2f517e194b12a3db5a6e6d87b5

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                1be0fb685eb3a5e714959fce7f54d8798220db135c3530d87a82b25677721b2a095f6242d3fb306673401af14bd40f0bbb48b4d24ed10c294b397795f71c2a2a

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                eeb0177d1c9b4553500c8220c52ac0bf

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                5c861107bef62e19833c1cbade44ef167a18e5c4

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                02230518759fd692790aaca2cf0b337cd4652f2f517e194b12a3db5a6e6d87b5

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                1be0fb685eb3a5e714959fce7f54d8798220db135c3530d87a82b25677721b2a095f6242d3fb306673401af14bd40f0bbb48b4d24ed10c294b397795f71c2a2a

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                524bc4a6aa806a49f783ad07f2de00c8

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                10bc25e6a1d4b66cda6faf0a89ae46b87e1c1162

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                b968152c71249b53f98af3dc9dcb081d78ba69e15c8ef3c137d2407a4cd723a3

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                951a996a3dcbf96105d0ddd96e0e466b0247e36fd05dc4bf3fe9be0467345633ac560b512de96afc65cf7a84e4849b24394a6f9a231e2dc60287158f5c29e2a8

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                524bc4a6aa806a49f783ad07f2de00c8

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                10bc25e6a1d4b66cda6faf0a89ae46b87e1c1162

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                b968152c71249b53f98af3dc9dcb081d78ba69e15c8ef3c137d2407a4cd723a3

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                951a996a3dcbf96105d0ddd96e0e466b0247e36fd05dc4bf3fe9be0467345633ac560b512de96afc65cf7a84e4849b24394a6f9a231e2dc60287158f5c29e2a8

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                d1cc1dd92395e8059e57a39ee56817b3

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                67690212c11c85d6ae751dbb752634d3c32a17d1

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                a6dccae57adcc56f72622412f4e28013f2e15cdbbd7495d9155e581f32a633c2

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                3f412e0f7b7db1a26f65f9f2f164f2565d4bfa9286263101938623922e18c81345502b0ee2e4b0a4749b8385eb735d929153814d7d9b28d2b853fb5f10adc019

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                d1cc1dd92395e8059e57a39ee56817b3

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                67690212c11c85d6ae751dbb752634d3c32a17d1

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                a6dccae57adcc56f72622412f4e28013f2e15cdbbd7495d9155e581f32a633c2

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                3f412e0f7b7db1a26f65f9f2f164f2565d4bfa9286263101938623922e18c81345502b0ee2e4b0a4749b8385eb735d929153814d7d9b28d2b853fb5f10adc019

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                4fe0a3451172ac54218f640f668dd51e

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                d33557b38bffc18d37985e35f25ee03de3ee9ef1

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                f12c8a424a3a4125b6408a362d302ffc4902ee04028ef75fa69ff9cffd1fd10e

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                5e0a492090f160c63e06c7270385a9582ae229f525391e40f0ea4623e910d94c6c4644772b3a957e41f8059fc7666bfb0f577779889c33bf8af477c6993c9115

                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                4fe0a3451172ac54218f640f668dd51e

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                d33557b38bffc18d37985e35f25ee03de3ee9ef1

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                f12c8a424a3a4125b6408a362d302ffc4902ee04028ef75fa69ff9cffd1fd10e

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                5e0a492090f160c63e06c7270385a9582ae229f525391e40f0ea4623e910d94c6c4644772b3a957e41f8059fc7666bfb0f577779889c33bf8af477c6993c9115

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3644261062\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                eb68cc9e182b2c2536e2cd79274130a9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                8646e901465e3a82c7f11fdb59fa979ad6eec1df

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                4e829d5b24e92accf23316fdc330c805a54b75c52b758c763c7a54cf4d27f60b

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                f9210f7dc4cc3288b3984fa65d5bc51ec29b886e93f1d416897d56d69dd5390b942ea50d2d81952fd7c4e4c92cddf209d39d4a8e5d5c89448277a8e1704fd7dc

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3644261062\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                eb68cc9e182b2c2536e2cd79274130a9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                8646e901465e3a82c7f11fdb59fa979ad6eec1df

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                4e829d5b24e92accf23316fdc330c805a54b75c52b758c763c7a54cf4d27f60b

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                f9210f7dc4cc3288b3984fa65d5bc51ec29b886e93f1d416897d56d69dd5390b942ea50d2d81952fd7c4e4c92cddf209d39d4a8e5d5c89448277a8e1704fd7dc

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                5bcc47be0bf0a7c81ef2f7db353d1b33

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a0fc04d390ef2aea7c357e56fecac22b7837e76c

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e5a039e30bad6ac035496de2b945998cb69540f0f09250fdb20700f0d35e79d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                81587997c2e8677d068a267c5a2aeb0c8e76584b3d1b57e024c699716af299cae23dc45fbdd025257e6c1abad6bbf23d4affcb9c04697fb78927caacf90cc53a

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                5bcc47be0bf0a7c81ef2f7db353d1b33

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a0fc04d390ef2aea7c357e56fecac22b7837e76c

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e5a039e30bad6ac035496de2b945998cb69540f0f09250fdb20700f0d35e79d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                81587997c2e8677d068a267c5a2aeb0c8e76584b3d1b57e024c699716af299cae23dc45fbdd025257e6c1abad6bbf23d4affcb9c04697fb78927caacf90cc53a

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                5bcc47be0bf0a7c81ef2f7db353d1b33

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a0fc04d390ef2aea7c357e56fecac22b7837e76c

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e5a039e30bad6ac035496de2b945998cb69540f0f09250fdb20700f0d35e79d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                81587997c2e8677d068a267c5a2aeb0c8e76584b3d1b57e024c699716af299cae23dc45fbdd025257e6c1abad6bbf23d4affcb9c04697fb78927caacf90cc53a

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                5bcc47be0bf0a7c81ef2f7db353d1b33

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a0fc04d390ef2aea7c357e56fecac22b7837e76c

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e5a039e30bad6ac035496de2b945998cb69540f0f09250fdb20700f0d35e79d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                81587997c2e8677d068a267c5a2aeb0c8e76584b3d1b57e024c699716af299cae23dc45fbdd025257e6c1abad6bbf23d4affcb9c04697fb78927caacf90cc53a

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                5bcc47be0bf0a7c81ef2f7db353d1b33

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a0fc04d390ef2aea7c357e56fecac22b7837e76c

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e5a039e30bad6ac035496de2b945998cb69540f0f09250fdb20700f0d35e79d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                81587997c2e8677d068a267c5a2aeb0c8e76584b3d1b57e024c699716af299cae23dc45fbdd025257e6c1abad6bbf23d4affcb9c04697fb78927caacf90cc53a

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                5bcc47be0bf0a7c81ef2f7db353d1b33

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a0fc04d390ef2aea7c357e56fecac22b7837e76c

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e5a039e30bad6ac035496de2b945998cb69540f0f09250fdb20700f0d35e79d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                81587997c2e8677d068a267c5a2aeb0c8e76584b3d1b57e024c699716af299cae23dc45fbdd025257e6c1abad6bbf23d4affcb9c04697fb78927caacf90cc53a

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                eb68cc9e182b2c2536e2cd79274130a9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                8646e901465e3a82c7f11fdb59fa979ad6eec1df

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                4e829d5b24e92accf23316fdc330c805a54b75c52b758c763c7a54cf4d27f60b

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                f9210f7dc4cc3288b3984fa65d5bc51ec29b886e93f1d416897d56d69dd5390b942ea50d2d81952fd7c4e4c92cddf209d39d4a8e5d5c89448277a8e1704fd7dc

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                eb68cc9e182b2c2536e2cd79274130a9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                8646e901465e3a82c7f11fdb59fa979ad6eec1df

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                4e829d5b24e92accf23316fdc330c805a54b75c52b758c763c7a54cf4d27f60b

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                f9210f7dc4cc3288b3984fa65d5bc51ec29b886e93f1d416897d56d69dd5390b942ea50d2d81952fd7c4e4c92cddf209d39d4a8e5d5c89448277a8e1704fd7dc

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                eb68cc9e182b2c2536e2cd79274130a9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                8646e901465e3a82c7f11fdb59fa979ad6eec1df

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                4e829d5b24e92accf23316fdc330c805a54b75c52b758c763c7a54cf4d27f60b

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                f9210f7dc4cc3288b3984fa65d5bc51ec29b886e93f1d416897d56d69dd5390b942ea50d2d81952fd7c4e4c92cddf209d39d4a8e5d5c89448277a8e1704fd7dc

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                eb68cc9e182b2c2536e2cd79274130a9

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                8646e901465e3a82c7f11fdb59fa979ad6eec1df

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                4e829d5b24e92accf23316fdc330c805a54b75c52b758c763c7a54cf4d27f60b

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                f9210f7dc4cc3288b3984fa65d5bc51ec29b886e93f1d416897d56d69dd5390b942ea50d2d81952fd7c4e4c92cddf209d39d4a8e5d5c89448277a8e1704fd7dc

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                5bcc47be0bf0a7c81ef2f7db353d1b33

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a0fc04d390ef2aea7c357e56fecac22b7837e76c

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e5a039e30bad6ac035496de2b945998cb69540f0f09250fdb20700f0d35e79d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                81587997c2e8677d068a267c5a2aeb0c8e76584b3d1b57e024c699716af299cae23dc45fbdd025257e6c1abad6bbf23d4affcb9c04697fb78927caacf90cc53a

                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                5bcc47be0bf0a7c81ef2f7db353d1b33

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                a0fc04d390ef2aea7c357e56fecac22b7837e76c

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                3e5a039e30bad6ac035496de2b945998cb69540f0f09250fdb20700f0d35e79d

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                81587997c2e8677d068a267c5a2aeb0c8e76584b3d1b57e024c699716af299cae23dc45fbdd025257e6c1abad6bbf23d4affcb9c04697fb78927caacf90cc53a

                                                                                                                                                                                                                                                                                                                                                              • C:\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7a2f09dadcdb53fed2a9b9c5aa2c409c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                46112257f95da09e367ca894d652c5913d354b4f

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                5b5eee5e99ddf6cce151803557dc06beeedbcf85c9982d40f5d3a62bc8c363ab

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                d9716f09c2bf6096a0e727f238640dd11e57491d9a49bdcd4bcc430465d192532125e6c090688f9d6f604de5543984964b926a99a26059a08d8c3d0e01f7357e

                                                                                                                                                                                                                                                                                                                                                              • C:\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                7a2f09dadcdb53fed2a9b9c5aa2c409c

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                46112257f95da09e367ca894d652c5913d354b4f

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                5b5eee5e99ddf6cce151803557dc06beeedbcf85c9982d40f5d3a62bc8c363ab

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                d9716f09c2bf6096a0e727f238640dd11e57491d9a49bdcd4bcc430465d192532125e6c090688f9d6f604de5543984964b926a99a26059a08d8c3d0e01f7357e

                                                                                                                                                                                                                                                                                                                                                              • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                252da02c100eff3d86d9181ff7b7d6d5

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                2408de96052eb94a501d426ce623638e15f50f3e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                fa8ca16911aa00caff95ffbc5b5226e5f4ea863322b6a76947a84f4eb8431198

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                b49202bf944691c2ae490d5c7b9eb1af35241852711955cf5d592a90a6533469ef1f86c5a21d3ac30206eec953509383615eae89f3f71d7759ef6eed369ebd70

                                                                                                                                                                                                                                                                                                                                                              • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                252da02c100eff3d86d9181ff7b7d6d5

                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                2408de96052eb94a501d426ce623638e15f50f3e

                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                fa8ca16911aa00caff95ffbc5b5226e5f4ea863322b6a76947a84f4eb8431198

                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                b49202bf944691c2ae490d5c7b9eb1af35241852711955cf5d592a90a6533469ef1f86c5a21d3ac30206eec953509383615eae89f3f71d7759ef6eed369ebd70