Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

77129f334c...79.exe

windows7-x64

10

77129f334c...79.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    193s
  • max time network
    219s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 14:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    77129f334c92c062dc6c29c57b28d73e4c9602d22439b4428ed9f74518106c79.exe

  • Size

    72KB

  • MD5

    10caa63381ebb2b29c7ccacbfe34a717

  • SHA1

    a0ffc12ee94fb77fa2dad07a72a2325d34edf871

  • SHA256

    77129f334c92c062dc6c29c57b28d73e4c9602d22439b4428ed9f74518106c79

  • SHA512

    3fe282d4a6f2b71ff052f819d13e7777b42d44140d40fa7f153f5bc145a3b48c93358a7c957e80bca043e08a1969fe822ca053f061a96453169910c902d052a6

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2N:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPZ

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\77129f334c92c062dc6c29c57b28d73e4c9602d22439b4428ed9f74518106c79.exe
    "C:\Users\Admin\AppData\Local\Temp\77129f334c92c062dc6c29c57b28d73e4c9602d22439b4428ed9f74518106c79.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Users\Admin\AppData\Local\Temp\2762280756\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2762280756\backup.exe C:\Users\Admin\AppData\Local\Temp\2762280756\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2884
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4304
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2248
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4924
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2780
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4140
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3888
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4552
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3012
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2032
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\update.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\update.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:4668
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:4700
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3468
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1364
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4264
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1888
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3952
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\update.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4756
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3384
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1988
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4872
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1984
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\data.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:1544
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • System policy modification
                  PID:1660
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:4984
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:4008
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Drops file in Program Files directory
                  • System policy modification
                  PID:3640
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                      PID:2152
                • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:3940
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2592
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5052
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4084
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3476
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:2204
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\System Restore.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:3472
                • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2512
                  • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1948
                • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4464
                • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2152
                • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:4412
                • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Drops file in Program Files directory
                  • System policy modification
                  PID:1964
                  • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                    8⤵
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:3796
                • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:4540
                  • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                    8⤵
                      PID:4992
                • C:\Program Files\Common Files\Services\backup.exe
                  "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                  6⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2632
                • C:\Program Files\Common Files\System\backup.exe
                  "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                  6⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:796
                  • C:\Program Files\Common Files\System\ado\backup.exe
                    "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1496
                    • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                      "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4244
                    • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                      "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                      8⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:4784
                    • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                      "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3272
                    • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                      "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:2384
                    • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                      "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                      8⤵
                        PID:3380
                      • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                        8⤵
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:4668
                    • C:\Program Files\Common Files\System\de-DE\backup.exe
                      "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                      7⤵
                      • System policy modification
                      PID:3064
                    • C:\Program Files\Common Files\System\en-US\backup.exe
                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:4796
                    • C:\Program Files\Common Files\System\it-IT\backup.exe
                      "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                      7⤵
                        PID:5096
                      • C:\Program Files\Common Files\System\fr-FR\backup.exe
                        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                        7⤵
                          PID:2156
                        • C:\Program Files\Common Files\System\es-ES\backup.exe
                          "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                          7⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:4964
                    • C:\Program Files\Google\backup.exe
                      "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious use of SetWindowsHookEx
                      PID:4584
                      • C:\Program Files\Google\Chrome\backup.exe
                        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                        6⤵
                        • Modifies visibility of file extensions in Explorer
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        PID:4352
                        • C:\Program Files\Google\Chrome\Application\backup.exe
                          "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                          7⤵
                          • Modifies visibility of file extensions in Explorer
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:3628
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                            8⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            PID:3972
                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                              9⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:3332
                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                              9⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:1344
                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                              9⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:3544
                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                              9⤵
                                PID:824
                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                9⤵
                                  PID:4152
                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                  9⤵
                                    PID:4372
                                • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                  "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:3952
                          • C:\Program Files\Internet Explorer\backup.exe
                            "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                            5⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            PID:4480
                            • C:\Program Files\Internet Explorer\de-DE\backup.exe
                              "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:3616
                            • C:\Program Files\Internet Explorer\en-US\backup.exe
                              "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2652
                            • C:\Program Files\Internet Explorer\es-ES\backup.exe
                              "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:760
                            • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                              "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:920
                            • C:\Program Files\Internet Explorer\images\backup.exe
                              "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                              6⤵
                              • Disables RegEdit via registry modification
                              PID:1556
                            • C:\Program Files\Internet Explorer\it-IT\data.exe
                              "C:\Program Files\Internet Explorer\it-IT\data.exe" C:\Program Files\Internet Explorer\it-IT\
                              6⤵
                              • Disables RegEdit via registry modification
                              • System policy modification
                              PID:1948
                            • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                              "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • System policy modification
                              PID:2080
                            • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                              "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:4608
                          • C:\Program Files\Java\backup.exe
                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                            5⤵
                            • Disables RegEdit via registry modification
                            PID:4136
                            • C:\Program Files\Java\jdk1.8.0_66\System Restore.exe
                              "C:\Program Files\Java\jdk1.8.0_66\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Drops file in Program Files directory
                              PID:4452
                              • C:\Program Files\Java\jdk1.8.0_66\bin\data.exe
                                "C:\Program Files\Java\jdk1.8.0_66\bin\data.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                PID:2820
                              • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                7⤵
                                  PID:8
                          • C:\Program Files (x86)\backup.exe
                            "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                            4⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            PID:1632
                            • C:\Program Files (x86)\Adobe\backup.exe
                              "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                              5⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              PID:3664
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                6⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:1804
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4252
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  PID:1704
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\update.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:3080
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                      9⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:1420
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\update.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • System policy modification
                                    PID:4176
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\data.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                  7⤵
                                  • Disables RegEdit via registry modification
                                  • Drops file in Program Files directory
                                  PID:4560
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:2652
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                      9⤵
                                      • Disables RegEdit via registry modification
                                      • System policy modification
                                      PID:4988
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\update.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:392
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                    8⤵
                                      PID:4160
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Drops file in Program Files directory
                                    PID:1368
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                      8⤵
                                      • Disables RegEdit via registry modification
                                      • System policy modification
                                      PID:936
                              • C:\Program Files (x86)\Common Files\backup.exe
                                "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                5⤵
                                • Disables RegEdit via registry modification
                                • Drops file in Program Files directory
                                PID:444
                                • C:\Program Files (x86)\Common Files\Adobe\update.exe
                                  "C:\Program Files (x86)\Common Files\Adobe\update.exe" C:\Program Files (x86)\Common Files\Adobe\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Drops file in Program Files directory
                                  PID:2120
                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Drops file in Program Files directory
                                    PID:432
                                  • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                    "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                    7⤵
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:2136
                            • C:\Users\backup.exe
                              C:\Users\backup.exe C:\Users\
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:4172
                              • C:\Users\Admin\backup.exe
                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                5⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1736
                                • C:\Users\Admin\3D Objects\backup.exe
                                  "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1844
                                • C:\Users\Admin\Contacts\backup.exe
                                  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2796
                                • C:\Users\Admin\Desktop\data.exe
                                  C:\Users\Admin\Desktop\data.exe C:\Users\Admin\Desktop\
                                  6⤵
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1120
                                • C:\Users\Admin\Documents\backup.exe
                                  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:2232
                                • C:\Users\Admin\Downloads\backup.exe
                                  C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                  6⤵
                                    PID:3592
                                  • C:\Users\Admin\Links\data.exe
                                    C:\Users\Admin\Links\data.exe C:\Users\Admin\Links\
                                    6⤵
                                    • Disables RegEdit via registry modification
                                    PID:4564
                                  • C:\Users\Admin\Music\backup.exe
                                    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                    6⤵
                                      PID:2384
                                    • C:\Users\Admin\Favorites\backup.exe
                                      C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                      6⤵
                                        PID:2584
                                    • C:\Users\Public\backup.exe
                                      C:\Users\Public\backup.exe C:\Users\Public\
                                      5⤵
                                      • Disables RegEdit via registry modification
                                      • System policy modification
                                      PID:2684
                                      • C:\Users\Public\Documents\data.exe
                                        C:\Users\Public\Documents\data.exe C:\Users\Public\Documents\
                                        6⤵
                                        • Disables RegEdit via registry modification
                                        • System policy modification
                                        PID:3616
                                      • C:\Users\Public\Downloads\backup.exe
                                        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                        6⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:1988
                                      • C:\Users\Public\Videos\backup.exe
                                        C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                        6⤵
                                          PID:884
                                        • C:\Users\Public\Pictures\backup.exe
                                          C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • System policy modification
                                          PID:3000
                                        • C:\Users\Public\Music\backup.exe
                                          C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                          6⤵
                                          • System policy modification
                                          PID:3920
                                    • C:\Windows\backup.exe
                                      C:\Windows\backup.exe C:\Windows\
                                      4⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Drops file in Windows directory
                                      • System policy modification
                                      PID:376
                                      • C:\Windows\addins\backup.exe
                                        C:\Windows\addins\backup.exe C:\Windows\addins\
                                        5⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • System policy modification
                                        PID:1212
                                      • C:\Windows\appcompat\data.exe
                                        C:\Windows\appcompat\data.exe C:\Windows\appcompat\
                                        5⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Drops file in Windows directory
                                        PID:4972
                                        • C:\Windows\appcompat\encapsulation\update.exe
                                          C:\Windows\appcompat\encapsulation\update.exe C:\Windows\appcompat\encapsulation\
                                          6⤵
                                            PID:1236
                                          • C:\Windows\appcompat\appraiser\backup.exe
                                            C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Drops file in Windows directory
                                            • System policy modification
                                            PID:4220
                                  • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                    C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1988
                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                    2⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:3664
                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                    C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3916
                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                    2⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4404
                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                    2⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:3640
                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe
                                    "C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                    2⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:3096
                                • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                  C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                  1⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  PID:3872
                                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                  1⤵
                                    PID:4232
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                    1⤵
                                      PID:3248

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\PerfLogs\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      bc67a19333acc6f9a877b3eda2eff4ca

                                      SHA1

                                      d3445655f75a8b92d0804d2798b9d44fdbe4e256

                                      SHA256

                                      ca261c318d6fe80ecb4038aa7386beab8a9f370b84dde8bebadfccae94a7f12c

                                      SHA512

                                      13d32152cc575b9428ee53a2ca6fbdf74c076c9ee4c9166e57f01f871bcc4ac80e57d0e8ab5046c7b0dd4f6de5b13bdc7410799b8ba5b1f88d0930f787c4aa2a

                                      Download Submit

                                    • C:\PerfLogs\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      bc67a19333acc6f9a877b3eda2eff4ca

                                      SHA1

                                      d3445655f75a8b92d0804d2798b9d44fdbe4e256

                                      SHA256

                                      ca261c318d6fe80ecb4038aa7386beab8a9f370b84dde8bebadfccae94a7f12c

                                      SHA512

                                      13d32152cc575b9428ee53a2ca6fbdf74c076c9ee4c9166e57f01f871bcc4ac80e57d0e8ab5046c7b0dd4f6de5b13bdc7410799b8ba5b1f88d0930f787c4aa2a

                                      Download Submit

                                    • C:\Program Files (x86)\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      5a16659719dab3f58f9792e7ce5e91f8

                                      SHA1

                                      a44850da3c798f54a4c5828386aa85aaca21ddb9

                                      SHA256

                                      cb2fa1533ec284d4fc5b02b7d0209dda91e3fb8b202eca0705d867ee568a2ed6

                                      SHA512

                                      8656f2f4ce5d5ca7e9672f47790d03b96d575ecc2dbca8c232cfc819eccaa3b7b040b9da9e39dcee07b0ea5a6206a4386f536a0450d56f0ff196fa0c35cc3f8a

                                      Download Submit

                                    • C:\Program Files (x86)\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      5a16659719dab3f58f9792e7ce5e91f8

                                      SHA1

                                      a44850da3c798f54a4c5828386aa85aaca21ddb9

                                      SHA256

                                      cb2fa1533ec284d4fc5b02b7d0209dda91e3fb8b202eca0705d867ee568a2ed6

                                      SHA512

                                      8656f2f4ce5d5ca7e9672f47790d03b96d575ecc2dbca8c232cfc819eccaa3b7b040b9da9e39dcee07b0ea5a6206a4386f536a0450d56f0ff196fa0c35cc3f8a

                                      Download Submit

                                    • C:\Program Files\7-Zip\Lang\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      b208435093ba81104d1511a20d8ea6b2

                                      SHA1

                                      b50ba9afc7d00d10db617a250d5fba9f8506d976

                                      SHA256

                                      270151de97f9c20372f5b667d8c9ad33e47ea5e458444ea2e5dd0cb8dd461041

                                      SHA512

                                      1e1b1dba5d740c8898d19c724f2c6a375af59dbf782eb179b159ed6f11c51b8064678b46ac338738029bf1d2aa86adb2b1c8d333afa7b993a257a197d4f997b7

                                      Download Submit

                                    • C:\Program Files\7-Zip\Lang\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      b208435093ba81104d1511a20d8ea6b2

                                      SHA1

                                      b50ba9afc7d00d10db617a250d5fba9f8506d976

                                      SHA256

                                      270151de97f9c20372f5b667d8c9ad33e47ea5e458444ea2e5dd0cb8dd461041

                                      SHA512

                                      1e1b1dba5d740c8898d19c724f2c6a375af59dbf782eb179b159ed6f11c51b8064678b46ac338738029bf1d2aa86adb2b1c8d333afa7b993a257a197d4f997b7

                                      Download Submit

                                    • C:\Program Files\7-Zip\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      12523bd573b215d525d0bec97a829e68

                                      SHA1

                                      a12144b884752f3080976b537698508a87badf48

                                      SHA256

                                      dbd86fa8c05e2474cf12537274af450605b65c7e53e0607ad39151ab863f5f9f

                                      SHA512

                                      da2bab97d799f7b95343287b928d49e32f93b527012b03752125aaf9fb61ff4f4a7d3e08c60dce2fd153ecffcd7c1a1262624687b6858078a5f27733d89681fe

                                      Download Submit

                                    • C:\Program Files\7-Zip\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      12523bd573b215d525d0bec97a829e68

                                      SHA1

                                      a12144b884752f3080976b537698508a87badf48

                                      SHA256

                                      dbd86fa8c05e2474cf12537274af450605b65c7e53e0607ad39151ab863f5f9f

                                      SHA512

                                      da2bab97d799f7b95343287b928d49e32f93b527012b03752125aaf9fb61ff4f4a7d3e08c60dce2fd153ecffcd7c1a1262624687b6858078a5f27733d89681fe

                                      Download Submit

                                    • C:\Program Files\Common Files\DESIGNER\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c6ab53494ffb6f2002b81d6f9a650d47

                                      SHA1

                                      67eadf8c2ab278f55a3c9f200e4bfb52c97945e4

                                      SHA256

                                      29ba967cacfe6d3338e32cefc55d940f567ed9d87877bbde55b47346b4223274

                                      SHA512

                                      0a411a2b9d7bf0110f8000fa47ba9d3b8a21c7ee0af246726cf5dee1cdc813e34610714c612650f6dfc72a06ad52859cb67137a9d27cc3d1949eedd9e6c0e163

                                      Download Submit

                                    • C:\Program Files\Common Files\DESIGNER\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c6ab53494ffb6f2002b81d6f9a650d47

                                      SHA1

                                      67eadf8c2ab278f55a3c9f200e4bfb52c97945e4

                                      SHA256

                                      29ba967cacfe6d3338e32cefc55d940f567ed9d87877bbde55b47346b4223274

                                      SHA512

                                      0a411a2b9d7bf0110f8000fa47ba9d3b8a21c7ee0af246726cf5dee1cdc813e34610714c612650f6dfc72a06ad52859cb67137a9d27cc3d1949eedd9e6c0e163

                                      Download Submit

                                    • C:\Program Files\Common Files\Services\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      6f20242333293a18bc2f1c75ad63dd65

                                      SHA1

                                      55a77ca83dd80dd76e54cbc256290ad5361039de

                                      SHA256

                                      181f4477d79ffd09832df717e2000ab3b5aee1a328f7ce27b9e51209bccec405

                                      SHA512

                                      b5e5b494240449f2c001f1489d88d4ad72b36802fd066006c50a91e089fa9f39a8861e73d025e59e0ecc1dc7866eff36f2bb321b3a08db8646c8476bf6488ed0

                                      Download Submit

                                    • C:\Program Files\Common Files\Services\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      6f20242333293a18bc2f1c75ad63dd65

                                      SHA1

                                      55a77ca83dd80dd76e54cbc256290ad5361039de

                                      SHA256

                                      181f4477d79ffd09832df717e2000ab3b5aee1a328f7ce27b9e51209bccec405

                                      SHA512

                                      b5e5b494240449f2c001f1489d88d4ad72b36802fd066006c50a91e089fa9f39a8861e73d025e59e0ecc1dc7866eff36f2bb321b3a08db8646c8476bf6488ed0

                                      Download Submit

                                    • C:\Program Files\Common Files\System\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      d3606a8c9f58cfe3265a53ac6adfc47b

                                      SHA1

                                      9463daa7daf4772296fd35d10c2b561100b83807

                                      SHA256

                                      37d1f240b9cb7f7ba5dab1d9fbb1ea92a3ea42bf5778680aebd5a761f47d493d

                                      SHA512

                                      ad03e537786f56d95da781c9a184c583d69d451c400a10826007eeefd2aec80f08d93c49e0b307c8694a67379522075e900d84d0338227c8a9054a5c730199df

                                      Download Submit

                                    • C:\Program Files\Common Files\System\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      d3606a8c9f58cfe3265a53ac6adfc47b

                                      SHA1

                                      9463daa7daf4772296fd35d10c2b561100b83807

                                      SHA256

                                      37d1f240b9cb7f7ba5dab1d9fbb1ea92a3ea42bf5778680aebd5a761f47d493d

                                      SHA512

                                      ad03e537786f56d95da781c9a184c583d69d451c400a10826007eeefd2aec80f08d93c49e0b307c8694a67379522075e900d84d0338227c8a9054a5c730199df

                                      Download Submit

                                    • C:\Program Files\Common Files\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      10cc44c43dd1771600afabb22a13a329

                                      SHA1

                                      cae85086dccf95591f8bd56dda5fc73ab3d2aba4

                                      SHA256

                                      fcfb78e8b7d97c10b02913bb5994d5d0c606f0314014771e4b165efd352df3f7

                                      SHA512

                                      3cf26b64d5eaf2cabb57cc33b0084a47b775342a025649df696a2b6e29fb709b18212432ad3a86610d6598f9a56a32ac00a13a40fcff571febfc1fea7507b985

                                      Download Submit

                                    • C:\Program Files\Common Files\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      10cc44c43dd1771600afabb22a13a329

                                      SHA1

                                      cae85086dccf95591f8bd56dda5fc73ab3d2aba4

                                      SHA256

                                      fcfb78e8b7d97c10b02913bb5994d5d0c606f0314014771e4b165efd352df3f7

                                      SHA512

                                      3cf26b64d5eaf2cabb57cc33b0084a47b775342a025649df696a2b6e29fb709b18212432ad3a86610d6598f9a56a32ac00a13a40fcff571febfc1fea7507b985

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ClickToRun\update.exe
                                      Filesize

                                      72KB

                                      MD5

                                      842fd6d62c826da1544becbd0973ac91

                                      SHA1

                                      69efb4f0a1409d690b3219cb3195662d6fdbc7d6

                                      SHA256

                                      1228d64911c987253f43af721439344bcb9b3a739a17ea6935775cd70ed076ef

                                      SHA512

                                      c455d522826e5c7308abb554a58536774a8b31f103de18db0659934d57b780eefa3cba1bf9ec4b29d6202829c9bd432f7ed44bd834e0fc5ce2f15ce3a282749b

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ClickToRun\update.exe
                                      Filesize

                                      72KB

                                      MD5

                                      842fd6d62c826da1544becbd0973ac91

                                      SHA1

                                      69efb4f0a1409d690b3219cb3195662d6fdbc7d6

                                      SHA256

                                      1228d64911c987253f43af721439344bcb9b3a739a17ea6935775cd70ed076ef

                                      SHA512

                                      c455d522826e5c7308abb554a58536774a8b31f103de18db0659934d57b780eefa3cba1bf9ec4b29d6202829c9bd432f7ed44bd834e0fc5ce2f15ce3a282749b

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      804e5069de82561a1383649b97a8e502

                                      SHA1

                                      00e195abc265e6fd1da508cad0da40899dd47ced

                                      SHA256

                                      e933add82560e01523662d41d24bdc4ebf0cb27f6a57dd5173205b9ae13bc4ff

                                      SHA512

                                      a6b39f19dce615a0fdf68c8fca340d591f75e864fb94123eb4c3315e76d270d6ea0754627cd050c62b00c384e993672a4cf3bc7d83beee2d2a72cd8c6f004bd6

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      804e5069de82561a1383649b97a8e502

                                      SHA1

                                      00e195abc265e6fd1da508cad0da40899dd47ced

                                      SHA256

                                      e933add82560e01523662d41d24bdc4ebf0cb27f6a57dd5173205b9ae13bc4ff

                                      SHA512

                                      a6b39f19dce615a0fdf68c8fca340d591f75e864fb94123eb4c3315e76d270d6ea0754627cd050c62b00c384e993672a4cf3bc7d83beee2d2a72cd8c6f004bd6

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      a9eb492e4217eb4f65eec64e4beeb29c

                                      SHA1

                                      64511b25a762b48cfea8cac50ca92e8d50bc6f4b

                                      SHA256

                                      2b1b49fceb7ede53c8a332f24a1cc13eeb4cde8ae0b1001382de5f3e56188661

                                      SHA512

                                      06c8467e490b83298e44ed05e5252de962410e0d4c34884efc3bb42bc0b7e730458198066ce03dad908bed98a00f1876ae35548bda050b72d86cd36823df146c

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      a9eb492e4217eb4f65eec64e4beeb29c

                                      SHA1

                                      64511b25a762b48cfea8cac50ca92e8d50bc6f4b

                                      SHA256

                                      2b1b49fceb7ede53c8a332f24a1cc13eeb4cde8ae0b1001382de5f3e56188661

                                      SHA512

                                      06c8467e490b83298e44ed05e5252de962410e0d4c34884efc3bb42bc0b7e730458198066ce03dad908bed98a00f1876ae35548bda050b72d86cd36823df146c

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      3280deb99d2cf00ab31107e81648e6d6

                                      SHA1

                                      127aa1aaec9795139e56548e428707df068eb642

                                      SHA256

                                      0f7d0885da7411207bc67ad8d4d7380efa2a977ed9a16148ac6199a9177f7748

                                      SHA512

                                      9f2bbb8c3fda1a3c146050a535f812dea519b0fd69ab778407145e7c3e59173b049ba5d03249df07acc529892c0b00f3799e15bbb8cb2fbacd08f79a900f10a1

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      3280deb99d2cf00ab31107e81648e6d6

                                      SHA1

                                      127aa1aaec9795139e56548e428707df068eb642

                                      SHA256

                                      0f7d0885da7411207bc67ad8d4d7380efa2a977ed9a16148ac6199a9177f7748

                                      SHA512

                                      9f2bbb8c3fda1a3c146050a535f812dea519b0fd69ab778407145e7c3e59173b049ba5d03249df07acc529892c0b00f3799e15bbb8cb2fbacd08f79a900f10a1

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      f4ca365234d0812a25d2608f61d85f84

                                      SHA1

                                      47a6f83dea312c9c0b12ee18edca02afb6cb2ab0

                                      SHA256

                                      8b49c88ee0b742aea41f63b075f0f59afda248abbbb8ccd8f2a9312d637b3f46

                                      SHA512

                                      95e3ad931215ee0f4f1e8e8729baf669206948fe5fabddcb1a18bc54e740060db01174a5811cd780bd815e64bbf0c1909f49a5f3e1fb8af10b5c5e9c94f84933

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      f4ca365234d0812a25d2608f61d85f84

                                      SHA1

                                      47a6f83dea312c9c0b12ee18edca02afb6cb2ab0

                                      SHA256

                                      8b49c88ee0b742aea41f63b075f0f59afda248abbbb8ccd8f2a9312d637b3f46

                                      SHA512

                                      95e3ad931215ee0f4f1e8e8729baf669206948fe5fabddcb1a18bc54e740060db01174a5811cd780bd815e64bbf0c1909f49a5f3e1fb8af10b5c5e9c94f84933

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      5c6159b01e50fc2a309e221da86662d3

                                      SHA1

                                      ae580dc8c3a9831fda0db8db733d9d4ce2a772ee

                                      SHA256

                                      f4643bed6686506d34bffa251948f5ea7508434fb59fc6fb9724874d1d0ec0ea

                                      SHA512

                                      c98cd1b73f78723d7ba56e58899931da2421fb1fc9cb7f7f257705947e39084ea0fd5443c9cda88957492e8577a51007e54b377bd8cb00cfc92e6c83a6d982e7

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      5c6159b01e50fc2a309e221da86662d3

                                      SHA1

                                      ae580dc8c3a9831fda0db8db733d9d4ce2a772ee

                                      SHA256

                                      f4643bed6686506d34bffa251948f5ea7508434fb59fc6fb9724874d1d0ec0ea

                                      SHA512

                                      c98cd1b73f78723d7ba56e58899931da2421fb1fc9cb7f7f257705947e39084ea0fd5443c9cda88957492e8577a51007e54b377bd8cb00cfc92e6c83a6d982e7

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe
                                      Filesize

                                      72KB

                                      MD5

                                      f4ca365234d0812a25d2608f61d85f84

                                      SHA1

                                      47a6f83dea312c9c0b12ee18edca02afb6cb2ab0

                                      SHA256

                                      8b49c88ee0b742aea41f63b075f0f59afda248abbbb8ccd8f2a9312d637b3f46

                                      SHA512

                                      95e3ad931215ee0f4f1e8e8729baf669206948fe5fabddcb1a18bc54e740060db01174a5811cd780bd815e64bbf0c1909f49a5f3e1fb8af10b5c5e9c94f84933

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe
                                      Filesize

                                      72KB

                                      MD5

                                      f4ca365234d0812a25d2608f61d85f84

                                      SHA1

                                      47a6f83dea312c9c0b12ee18edca02afb6cb2ab0

                                      SHA256

                                      8b49c88ee0b742aea41f63b075f0f59afda248abbbb8ccd8f2a9312d637b3f46

                                      SHA512

                                      95e3ad931215ee0f4f1e8e8729baf669206948fe5fabddcb1a18bc54e740060db01174a5811cd780bd815e64bbf0c1909f49a5f3e1fb8af10b5c5e9c94f84933

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      e1d59f08c47499b763472909f7a25655

                                      SHA1

                                      6de6cc509906ed19a685a2b5e0194d75e18549c1

                                      SHA256

                                      a994d13c3b647b77c7a845842040e474c6f5e554c0a177f64d8d2ff4e9e15e45

                                      SHA512

                                      307f98167c10686a72a4b8fffd27bd98b09ebc807f1ed82492b1823cc1982e8f251709f4f1af59b84a4b5265f281a26d1ffdd18584f8df9e458f895077309734

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      e1d59f08c47499b763472909f7a25655

                                      SHA1

                                      6de6cc509906ed19a685a2b5e0194d75e18549c1

                                      SHA256

                                      a994d13c3b647b77c7a845842040e474c6f5e554c0a177f64d8d2ff4e9e15e45

                                      SHA512

                                      307f98167c10686a72a4b8fffd27bd98b09ebc807f1ed82492b1823cc1982e8f251709f4f1af59b84a4b5265f281a26d1ffdd18584f8df9e458f895077309734

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      e1d59f08c47499b763472909f7a25655

                                      SHA1

                                      6de6cc509906ed19a685a2b5e0194d75e18549c1

                                      SHA256

                                      a994d13c3b647b77c7a845842040e474c6f5e554c0a177f64d8d2ff4e9e15e45

                                      SHA512

                                      307f98167c10686a72a4b8fffd27bd98b09ebc807f1ed82492b1823cc1982e8f251709f4f1af59b84a4b5265f281a26d1ffdd18584f8df9e458f895077309734

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      e1d59f08c47499b763472909f7a25655

                                      SHA1

                                      6de6cc509906ed19a685a2b5e0194d75e18549c1

                                      SHA256

                                      a994d13c3b647b77c7a845842040e474c6f5e554c0a177f64d8d2ff4e9e15e45

                                      SHA512

                                      307f98167c10686a72a4b8fffd27bd98b09ebc807f1ed82492b1823cc1982e8f251709f4f1af59b84a4b5265f281a26d1ffdd18584f8df9e458f895077309734

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      996ce91c61642ac69213ba3dc4884974

                                      SHA1

                                      6eb9ee949df71b36e7eecf803c81528d2614b450

                                      SHA256

                                      fb90c129c13594d6a556359e6adce3e41e8e1629c702397678dff69d751233f5

                                      SHA512

                                      fdf4c135f8062c9efaffa55280c3d77e95369436118bfd4954514080b6ce3472160f931e76167e5d5ab298ae237854434a033dd3a3b77aa7e0f4b9aae5748d04

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      996ce91c61642ac69213ba3dc4884974

                                      SHA1

                                      6eb9ee949df71b36e7eecf803c81528d2614b450

                                      SHA256

                                      fb90c129c13594d6a556359e6adce3e41e8e1629c702397678dff69d751233f5

                                      SHA512

                                      fdf4c135f8062c9efaffa55280c3d77e95369436118bfd4954514080b6ce3472160f931e76167e5d5ab298ae237854434a033dd3a3b77aa7e0f4b9aae5748d04

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\el-GR\update.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c2129d662fad731be3c92204f01b95d1

                                      SHA1

                                      d2dbbfac8fde6a731d03942488360710019f73fb

                                      SHA256

                                      286fced19fce919e8685b803b64ba5c856aadaccced4e24096b03963a6b50ea4

                                      SHA512

                                      e5eb7754df0aeddbb0f575862ce8a1e86c77b30217d7f5e82ea547209c07cd18cc3a265d3284261a8acdfc69d37cc1bdcd42db5afdcbe984e8f5df09e90c579d

                                      Download Submit

                                    • C:\Program Files\Common Files\microsoft shared\ink\el-GR\update.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c2129d662fad731be3c92204f01b95d1

                                      SHA1

                                      d2dbbfac8fde6a731d03942488360710019f73fb

                                      SHA256

                                      286fced19fce919e8685b803b64ba5c856aadaccced4e24096b03963a6b50ea4

                                      SHA512

                                      e5eb7754df0aeddbb0f575862ce8a1e86c77b30217d7f5e82ea547209c07cd18cc3a265d3284261a8acdfc69d37cc1bdcd42db5afdcbe984e8f5df09e90c579d

                                      Download Submit

                                    • C:\Program Files\Google\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      824f7b25e72f632b9b3862a8b2d2aafa

                                      SHA1

                                      0bf8665b865668e7d5e0648b282db064d1100704

                                      SHA256

                                      a6a6b12dca7c456cbc145b48f1c51227d77b8be881c8ea55ddfee4eca6b32214

                                      SHA512

                                      546f6f97aeb7a1a34192291e315e1523d734b3b6322cf6dec523cb07d51e386b40877eb195d4fb6b17c3ea4d876aa7662700f712a90ae08eb6e7262e21789126

                                      Download Submit

                                    • C:\Program Files\Google\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      824f7b25e72f632b9b3862a8b2d2aafa

                                      SHA1

                                      0bf8665b865668e7d5e0648b282db064d1100704

                                      SHA256

                                      a6a6b12dca7c456cbc145b48f1c51227d77b8be881c8ea55ddfee4eca6b32214

                                      SHA512

                                      546f6f97aeb7a1a34192291e315e1523d734b3b6322cf6dec523cb07d51e386b40877eb195d4fb6b17c3ea4d876aa7662700f712a90ae08eb6e7262e21789126

                                      Download Submit

                                    • C:\Program Files\Internet Explorer\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      f328f62962153383b81b9728a9ce1149

                                      SHA1

                                      d22218fefbf9860b510ede8b07537969a03966c2

                                      SHA256

                                      c093a71a2bc3bdf687d401e200d8ebb9c9608ce825334ab0b2c5e7375ab48569

                                      SHA512

                                      bd09e9e0a96df184eac0befed8d1c17e65d81d6d8b0388137443e5e78010a53daf28ccff507ae9a8bebfd7647bdb5481d892c23178989b079cbecc86f1887ce5

                                      Download Submit

                                    • C:\Program Files\Internet Explorer\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      f328f62962153383b81b9728a9ce1149

                                      SHA1

                                      d22218fefbf9860b510ede8b07537969a03966c2

                                      SHA256

                                      c093a71a2bc3bdf687d401e200d8ebb9c9608ce825334ab0b2c5e7375ab48569

                                      SHA512

                                      bd09e9e0a96df184eac0befed8d1c17e65d81d6d8b0388137443e5e78010a53daf28ccff507ae9a8bebfd7647bdb5481d892c23178989b079cbecc86f1887ce5

                                      Download Submit

                                    • C:\Program Files\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      bc67a19333acc6f9a877b3eda2eff4ca

                                      SHA1

                                      d3445655f75a8b92d0804d2798b9d44fdbe4e256

                                      SHA256

                                      ca261c318d6fe80ecb4038aa7386beab8a9f370b84dde8bebadfccae94a7f12c

                                      SHA512

                                      13d32152cc575b9428ee53a2ca6fbdf74c076c9ee4c9166e57f01f871bcc4ac80e57d0e8ab5046c7b0dd4f6de5b13bdc7410799b8ba5b1f88d0930f787c4aa2a

                                      Download Submit

                                    • C:\Program Files\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      bc67a19333acc6f9a877b3eda2eff4ca

                                      SHA1

                                      d3445655f75a8b92d0804d2798b9d44fdbe4e256

                                      SHA256

                                      ca261c318d6fe80ecb4038aa7386beab8a9f370b84dde8bebadfccae94a7f12c

                                      SHA512

                                      13d32152cc575b9428ee53a2ca6fbdf74c076c9ee4c9166e57f01f871bcc4ac80e57d0e8ab5046c7b0dd4f6de5b13bdc7410799b8ba5b1f88d0930f787c4aa2a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\2762280756\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c9194f2659977402d252c27c02141640

                                      SHA1

                                      6e197e6bab5e2504255bc4ef1eff91beae0d65e6

                                      SHA256

                                      c73ab31c742ca03f2c5e886648d0093dd1d87bc0933c62b1cec96e966233cc87

                                      SHA512

                                      c46b5fa67c3b6c5eb2fa8a54ec1c3a4cf1861c95815539d51070e901763797b50df9287a32442f6da7327704899ff77b6c8dd78a5aab7793ee641ef988dae8e9

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\2762280756\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c9194f2659977402d252c27c02141640

                                      SHA1

                                      6e197e6bab5e2504255bc4ef1eff91beae0d65e6

                                      SHA256

                                      c73ab31c742ca03f2c5e886648d0093dd1d87bc0933c62b1cec96e966233cc87

                                      SHA512

                                      c46b5fa67c3b6c5eb2fa8a54ec1c3a4cf1861c95815539d51070e901763797b50df9287a32442f6da7327704899ff77b6c8dd78a5aab7793ee641ef988dae8e9

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      4519ce0fc04f140603925398d8d6fe96

                                      SHA1

                                      d765ca30a2c9eaa1694a120ed3de7a34f913363b

                                      SHA256

                                      84f2d913919b171b7e146e732595150d2e27ff853e2c30acacc0d9cb6f00e775

                                      SHA512

                                      5a82a0540fbb2a5a20c61ecafc3fc45f4adc67f32a0729851655c338b35a3cb38180b5ab4d5fa34c98972eeb02e3b9f9865f2b25413fc4870374e30974ee515a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      4519ce0fc04f140603925398d8d6fe96

                                      SHA1

                                      d765ca30a2c9eaa1694a120ed3de7a34f913363b

                                      SHA256

                                      84f2d913919b171b7e146e732595150d2e27ff853e2c30acacc0d9cb6f00e775

                                      SHA512

                                      5a82a0540fbb2a5a20c61ecafc3fc45f4adc67f32a0729851655c338b35a3cb38180b5ab4d5fa34c98972eeb02e3b9f9865f2b25413fc4870374e30974ee515a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      4519ce0fc04f140603925398d8d6fe96

                                      SHA1

                                      d765ca30a2c9eaa1694a120ed3de7a34f913363b

                                      SHA256

                                      84f2d913919b171b7e146e732595150d2e27ff853e2c30acacc0d9cb6f00e775

                                      SHA512

                                      5a82a0540fbb2a5a20c61ecafc3fc45f4adc67f32a0729851655c338b35a3cb38180b5ab4d5fa34c98972eeb02e3b9f9865f2b25413fc4870374e30974ee515a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      4519ce0fc04f140603925398d8d6fe96

                                      SHA1

                                      d765ca30a2c9eaa1694a120ed3de7a34f913363b

                                      SHA256

                                      84f2d913919b171b7e146e732595150d2e27ff853e2c30acacc0d9cb6f00e775

                                      SHA512

                                      5a82a0540fbb2a5a20c61ecafc3fc45f4adc67f32a0729851655c338b35a3cb38180b5ab4d5fa34c98972eeb02e3b9f9865f2b25413fc4870374e30974ee515a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      4519ce0fc04f140603925398d8d6fe96

                                      SHA1

                                      d765ca30a2c9eaa1694a120ed3de7a34f913363b

                                      SHA256

                                      84f2d913919b171b7e146e732595150d2e27ff853e2c30acacc0d9cb6f00e775

                                      SHA512

                                      5a82a0540fbb2a5a20c61ecafc3fc45f4adc67f32a0729851655c338b35a3cb38180b5ab4d5fa34c98972eeb02e3b9f9865f2b25413fc4870374e30974ee515a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      4519ce0fc04f140603925398d8d6fe96

                                      SHA1

                                      d765ca30a2c9eaa1694a120ed3de7a34f913363b

                                      SHA256

                                      84f2d913919b171b7e146e732595150d2e27ff853e2c30acacc0d9cb6f00e775

                                      SHA512

                                      5a82a0540fbb2a5a20c61ecafc3fc45f4adc67f32a0729851655c338b35a3cb38180b5ab4d5fa34c98972eeb02e3b9f9865f2b25413fc4870374e30974ee515a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c9194f2659977402d252c27c02141640

                                      SHA1

                                      6e197e6bab5e2504255bc4ef1eff91beae0d65e6

                                      SHA256

                                      c73ab31c742ca03f2c5e886648d0093dd1d87bc0933c62b1cec96e966233cc87

                                      SHA512

                                      c46b5fa67c3b6c5eb2fa8a54ec1c3a4cf1861c95815539d51070e901763797b50df9287a32442f6da7327704899ff77b6c8dd78a5aab7793ee641ef988dae8e9

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c9194f2659977402d252c27c02141640

                                      SHA1

                                      6e197e6bab5e2504255bc4ef1eff91beae0d65e6

                                      SHA256

                                      c73ab31c742ca03f2c5e886648d0093dd1d87bc0933c62b1cec96e966233cc87

                                      SHA512

                                      c46b5fa67c3b6c5eb2fa8a54ec1c3a4cf1861c95815539d51070e901763797b50df9287a32442f6da7327704899ff77b6c8dd78a5aab7793ee641ef988dae8e9

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c9194f2659977402d252c27c02141640

                                      SHA1

                                      6e197e6bab5e2504255bc4ef1eff91beae0d65e6

                                      SHA256

                                      c73ab31c742ca03f2c5e886648d0093dd1d87bc0933c62b1cec96e966233cc87

                                      SHA512

                                      c46b5fa67c3b6c5eb2fa8a54ec1c3a4cf1861c95815539d51070e901763797b50df9287a32442f6da7327704899ff77b6c8dd78a5aab7793ee641ef988dae8e9

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      c9194f2659977402d252c27c02141640

                                      SHA1

                                      6e197e6bab5e2504255bc4ef1eff91beae0d65e6

                                      SHA256

                                      c73ab31c742ca03f2c5e886648d0093dd1d87bc0933c62b1cec96e966233cc87

                                      SHA512

                                      c46b5fa67c3b6c5eb2fa8a54ec1c3a4cf1861c95815539d51070e901763797b50df9287a32442f6da7327704899ff77b6c8dd78a5aab7793ee641ef988dae8e9

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe
                                      Filesize

                                      72KB

                                      MD5

                                      b92d3a94fa9ce03e525dc7c0f429d149

                                      SHA1

                                      f5cd4e54acc0b8d4873691360064edd8304d7348

                                      SHA256

                                      8690b7beac9c99fbe65a5abfc831fb1b503edf44cad339869f23900422805d10

                                      SHA512

                                      c0455c8ad8dac0fc0ec555e47a8ac62603832a4201d071accca8edaeb31cfb420b0833631390664c684580c2c58a21a834e9a3a5d38a2ea74403f34bf8fc5e77

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe
                                      Filesize

                                      72KB

                                      MD5

                                      b92d3a94fa9ce03e525dc7c0f429d149

                                      SHA1

                                      f5cd4e54acc0b8d4873691360064edd8304d7348

                                      SHA256

                                      8690b7beac9c99fbe65a5abfc831fb1b503edf44cad339869f23900422805d10

                                      SHA512

                                      c0455c8ad8dac0fc0ec555e47a8ac62603832a4201d071accca8edaeb31cfb420b0833631390664c684580c2c58a21a834e9a3a5d38a2ea74403f34bf8fc5e77

                                      Download Submit

                                    • C:\Users\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      19e92479ae946f5b0027a21af6a1ec6c

                                      SHA1

                                      fa9a18569ea4789442498a4feaf02b4eddab4dda

                                      SHA256

                                      0df8208a489acb37a5730a6cbbc35ff2244bc4633d5dc9ad15d6d6f872325b13

                                      SHA512

                                      115e1fe54566a2c1226f829ed253f768bbddb50981445f50c4d819a482cdd16856d8a94e3dff3bc231aa4fcaeebe7e51fe5d425e070bcd96247c4deaf8b31db5

                                      Download Submit

                                    • C:\Users\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      19e92479ae946f5b0027a21af6a1ec6c

                                      SHA1

                                      fa9a18569ea4789442498a4feaf02b4eddab4dda

                                      SHA256

                                      0df8208a489acb37a5730a6cbbc35ff2244bc4633d5dc9ad15d6d6f872325b13

                                      SHA512

                                      115e1fe54566a2c1226f829ed253f768bbddb50981445f50c4d819a482cdd16856d8a94e3dff3bc231aa4fcaeebe7e51fe5d425e070bcd96247c4deaf8b31db5

                                      Download Submit

                                    • C:\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      606ef1f4cb18a0a90aa1625e06536ba8

                                      SHA1

                                      21229b081afd5931300fa578504865e5d51a144a

                                      SHA256

                                      3ab19d073af6c661bf9b12a769b6b6217ee9d0d4403348b250bf8fde15c2eb37

                                      SHA512

                                      12545e8d464367b42e2de1a4177f61687899412285eabbfe61c9d07c80f310a190ff34b990f5483b59627fcc5c4952fed0a47d6eb3cfb5e9afcab9443897f379

                                      Download Submit

                                    • C:\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      606ef1f4cb18a0a90aa1625e06536ba8

                                      SHA1

                                      21229b081afd5931300fa578504865e5d51a144a

                                      SHA256

                                      3ab19d073af6c661bf9b12a769b6b6217ee9d0d4403348b250bf8fde15c2eb37

                                      SHA512

                                      12545e8d464367b42e2de1a4177f61687899412285eabbfe61c9d07c80f310a190ff34b990f5483b59627fcc5c4952fed0a47d6eb3cfb5e9afcab9443897f379

                                      Download Submit

                                    • C:\odt\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      bc67a19333acc6f9a877b3eda2eff4ca

                                      SHA1

                                      d3445655f75a8b92d0804d2798b9d44fdbe4e256

                                      SHA256

                                      ca261c318d6fe80ecb4038aa7386beab8a9f370b84dde8bebadfccae94a7f12c

                                      SHA512

                                      13d32152cc575b9428ee53a2ca6fbdf74c076c9ee4c9166e57f01f871bcc4ac80e57d0e8ab5046c7b0dd4f6de5b13bdc7410799b8ba5b1f88d0930f787c4aa2a

                                      Download Submit

                                    • C:\odt\backup.exe
                                      Filesize

                                      72KB

                                      MD5

                                      bc67a19333acc6f9a877b3eda2eff4ca

                                      SHA1

                                      d3445655f75a8b92d0804d2798b9d44fdbe4e256

                                      SHA256

                                      ca261c318d6fe80ecb4038aa7386beab8a9f370b84dde8bebadfccae94a7f12c

                                      SHA512

                                      13d32152cc575b9428ee53a2ca6fbdf74c076c9ee4c9166e57f01f871bcc4ac80e57d0e8ab5046c7b0dd4f6de5b13bdc7410799b8ba5b1f88d0930f787c4aa2a

                                      Download Submit