Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    187s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 14:23

General

  • Target

    4bbb004635391dab6ee614cae6feb3de993a1b433f2fbfa1547f59330cc4f4ef.exe

  • Size

    72KB

  • MD5

    02986cde35c69b347bc99b13a8335f16

  • SHA1

    55efdc1005ffd60d0beeabbf974427b95287b366

  • SHA256

    4bbb004635391dab6ee614cae6feb3de993a1b433f2fbfa1547f59330cc4f4ef

  • SHA512

    e3c83e030fa65d990e3ec6211cd61e430ad6aa9a56b7b4cb47920f3774eaeb7086d2031598e8d3e4cbe14ca2a35b18f69c6bf304901c3869b0123c0338501716

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2W:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPC

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bbb004635391dab6ee614cae6feb3de993a1b433f2fbfa1547f59330cc4f4ef.exe
    "C:\Users\Admin\AppData\Local\Temp\4bbb004635391dab6ee614cae6feb3de993a1b433f2fbfa1547f59330cc4f4ef.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3380
    • C:\Users\Admin\AppData\Local\Temp\3817019113\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3817019113\backup.exe C:\Users\Admin\AppData\Local\Temp\3817019113\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\System Restore.exe
        "\System Restore.exe" \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2864
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4960
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1492
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4436
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3704
          • C:\Program Files\Common Files\update.exe
            "C:\Program Files\Common Files\update.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3172
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4268
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:980
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1416
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:996
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3552
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4544
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1200
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2448
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2896
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4492
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1528
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1504
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2892
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:480
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4048
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4036
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1340
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4304
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2280
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1160
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    PID:700
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:4492
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                      PID:3952
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                      9⤵
                        PID:2152
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                        9⤵
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:4892
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                        9⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:2572
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                        9⤵
                          PID:216
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\update.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                          9⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          PID:4780
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                          9⤵
                          • Disables RegEdit via registry modification
                          PID:3532
                      • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:804
                      • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • System policy modification
                        PID:4696
                      • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                        8⤵
                          PID:3572
                        • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                          8⤵
                            PID:2516
                          • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:2652
                          • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                            8⤵
                            • System policy modification
                            PID:4200
                          • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\System Restore.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:4844
                          • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • System policy modification
                            PID:3132
                          • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            PID:2668
                          • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                            8⤵
                              PID:4660
                            • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              PID:4820
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                            7⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:4388
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4780
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                              8⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:4980
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1972
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2184
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:2476
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                              8⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:3688
                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\data.exe
                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\data.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            PID:4344
                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\update.exe
                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\update.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                              8⤵
                                PID:3368
                            • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                              7⤵
                              • Disables RegEdit via registry modification
                              PID:4872
                            • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                              7⤵
                              • Disables RegEdit via registry modification
                              PID:4700
                            • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              PID:2128
                            • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Drops file in Program Files directory
                              PID:3404
                              • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                8⤵
                                  PID:516
                              • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                7⤵
                                • Drops file in Program Files directory
                                PID:4384
                                • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                  8⤵
                                    PID:4908
                                • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  PID:2436
                                • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                  7⤵
                                  • System policy modification
                                  PID:4712
                                • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                  7⤵
                                    PID:636
                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Drops file in Program Files directory
                                      • System policy modification
                                      PID:2412
                                      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\System Restore.exe
                                        "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\System Restore.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                        9⤵
                                        • System policy modification
                                        PID:3764
                                • C:\Program Files\Common Files\Services\backup.exe
                                  "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                  6⤵
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2036
                                • C:\Program Files\Common Files\System\backup.exe
                                  "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:3360
                                  • C:\Program Files\Common Files\System\ado\backup.exe
                                    "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4720
                                    • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                      "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:1288
                                    • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                      "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1400
                                    • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                      "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                      8⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4772
                                    • C:\Program Files\Common Files\System\ado\fr-FR\data.exe
                                      "C:\Program Files\Common Files\System\ado\fr-FR\data.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                      8⤵
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4452
                                    • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                      "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                      8⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:3784
                                    • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                      8⤵
                                      • System policy modification
                                      PID:1944
                                  • C:\Program Files\Common Files\System\de-DE\backup.exe
                                    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:3972
                                  • C:\Program Files\Common Files\System\en-US\backup.exe
                                    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                    7⤵
                                      PID:3576
                                    • C:\Program Files\Common Files\System\es-ES\backup.exe
                                      "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                      7⤵
                                        PID:4068
                                      • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                        7⤵
                                        • Disables RegEdit via registry modification
                                        PID:1460
                                      • C:\Program Files\Common Files\System\it-IT\backup.exe
                                        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • System policy modification
                                        PID:4372
                                      • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                        "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                        7⤵
                                          PID:3816
                                        • C:\Program Files\Common Files\System\msadc\backup.exe
                                          "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                          7⤵
                                          • Disables RegEdit via registry modification
                                          • Drops file in Program Files directory
                                          PID:3792
                                          • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                            "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                            8⤵
                                              PID:396
                                            • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                              "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                              8⤵
                                                PID:4928
                                              • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System policy modification
                                                PID:4444
                                              • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System policy modification
                                                PID:5004
                                              • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                8⤵
                                                • Disables RegEdit via registry modification
                                                • System policy modification
                                                PID:480
                                              • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                8⤵
                                                  PID:1156
                                              • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System policy modification
                                                PID:4000
                                                • C:\Program Files\Common Files\System\Ole DB\de-DE\System Restore.exe
                                                  "C:\Program Files\Common Files\System\Ole DB\de-DE\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                  8⤵
                                                    PID:3872
                                                  • C:\Program Files\Common Files\System\Ole DB\en-US\System Restore.exe
                                                    "C:\Program Files\Common Files\System\Ole DB\en-US\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                    8⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:5048
                                                  • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                    "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                    8⤵
                                                      PID:2784
                                                    • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                      "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                      8⤵
                                                        PID:4620
                                                • C:\Program Files\Google\backup.exe
                                                  "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                  5⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4880
                                                  • C:\Program Files\Google\Chrome\update.exe
                                                    "C:\Program Files\Google\Chrome\update.exe" C:\Program Files\Google\Chrome\
                                                    6⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1028
                                                    • C:\Program Files\Google\Chrome\Application\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1260
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                        8⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4200
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                          9⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3816
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                          9⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:808
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                          9⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1620
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                          9⤵
                                                            PID:3764
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                            9⤵
                                                            • Disables RegEdit via registry modification
                                                            PID:3788
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                            9⤵
                                                              PID:3568
                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                              9⤵
                                                                PID:800
                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                9⤵
                                                                  PID:4596
                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                    10⤵
                                                                    • Drops file in Program Files directory
                                                                    PID:5004
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                      11⤵
                                                                        PID:2780
                                                                • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:1524
                                                          • C:\Program Files\Internet Explorer\update.exe
                                                            "C:\Program Files\Internet Explorer\update.exe" C:\Program Files\Internet Explorer\
                                                            5⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            PID:1400
                                                            • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                              "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                              6⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:4624
                                                            • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                              "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                              6⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System policy modification
                                                              PID:672
                                                            • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                              "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                              6⤵
                                                              • System policy modification
                                                              PID:544
                                                            • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                              "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                              6⤵
                                                                PID:4752
                                                              • C:\Program Files\Internet Explorer\images\backup.exe
                                                                "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                6⤵
                                                                • Disables RegEdit via registry modification
                                                                • System policy modification
                                                                PID:2684
                                                              • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                6⤵
                                                                • System policy modification
                                                                PID:4428
                                                              • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • System policy modification
                                                                PID:3748
                                                              • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                6⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:4120
                                                            • C:\Program Files\Java\backup.exe
                                                              "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                              5⤵
                                                              • Drops file in Program Files directory
                                                              PID:2440
                                                              • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Drops file in Program Files directory
                                                                PID:544
                                                                • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                  "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                  7⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System policy modification
                                                                  PID:688
                                                                • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                  7⤵
                                                                    PID:3296
                                                            • C:\Program Files (x86)\backup.exe
                                                              "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              • System policy modification
                                                              PID:2960
                                                              • C:\Program Files (x86)\Adobe\backup.exe
                                                                "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                5⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3564
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1088
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\System Restore.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                    7⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:4248
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\data.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                    7⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Executes dropped EXE
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:4884
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                      8⤵
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:3872
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                        9⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:2488
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                      8⤵
                                                                      • Disables RegEdit via registry modification
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:4496
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                        9⤵
                                                                          PID:2324
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                        8⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:4756
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                        8⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:1868
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                        8⤵
                                                                          PID:2796
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • System policy modification
                                                                            PID:2984
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Drops file in Program Files directory
                                                                          PID:64
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:4116
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                          8⤵
                                                                            PID:1344
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Drops file in Program Files directory
                                                                            • System policy modification
                                                                            PID:1152
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              PID:4464
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            PID:4776
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\System Restore.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • System policy modification
                                                                              PID:2200
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                            8⤵
                                                                            • Drops file in Program Files directory
                                                                            • System policy modification
                                                                            PID:4896
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Drops file in Program Files directory
                                                                              • System policy modification
                                                                              PID:1392
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                10⤵
                                                                                  PID:1784
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                9⤵
                                                                                  PID:2396
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                              7⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • Drops file in Program Files directory
                                                                              PID:4352
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                8⤵
                                                                                • Drops file in Program Files directory
                                                                                PID:1108
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                  9⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  • System policy modification
                                                                                  PID:1836
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                8⤵
                                                                                  PID:1932
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                  8⤵
                                                                                    PID:3048
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                      9⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Drops file in Program Files directory
                                                                                      PID:4368
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                        10⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        PID:4960
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                        10⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Drops file in Program Files directory
                                                                                        PID:3788
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                          11⤵
                                                                                            PID:2896
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                            11⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Disables RegEdit via registry modification
                                                                                            • System policy modification
                                                                                            PID:1932
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\System Restore.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                            11⤵
                                                                                              PID:1544
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                      7⤵
                                                                                        PID:4256
                                                                                  • C:\Program Files (x86)\Common Files\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                    5⤵
                                                                                    • System policy modification
                                                                                    PID:3272
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\System Restore.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                      6⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Drops file in Program Files directory
                                                                                      PID:1564
                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                        7⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Drops file in Program Files directory
                                                                                        PID:4676
                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                        7⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • System policy modification
                                                                                        PID:2360
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\System Restore.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                          8⤵
                                                                                          • System policy modification
                                                                                          PID:1232
                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                        7⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Drops file in Program Files directory
                                                                                        • System policy modification
                                                                                        PID:3256
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                          8⤵
                                                                                          • System policy modification
                                                                                          PID:1828
                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\data.exe
                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                        7⤵
                                                                                        • System policy modification
                                                                                        PID:4056
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                          8⤵
                                                                                            PID:3096
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                              9⤵
                                                                                                PID:2516
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                  10⤵
                                                                                                    PID:1232
                                                                                        • C:\Program Files (x86)\Google\backup.exe
                                                                                          "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                          5⤵
                                                                                            PID:4016
                                                                                        • C:\Users\backup.exe
                                                                                          C:\Users\backup.exe C:\Users\
                                                                                          4⤵
                                                                                            PID:4932
                                                                                            • C:\Users\Admin\backup.exe
                                                                                              C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                              5⤵
                                                                                                PID:1188
                                                                                                • C:\Users\Admin\3D Objects\backup.exe
                                                                                                  "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                  6⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  PID:3464
                                                                                                • C:\Users\Admin\Contacts\backup.exe
                                                                                                  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                  6⤵
                                                                                                    PID:1900
                                                                                                  • C:\Users\Admin\Desktop\backup.exe
                                                                                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                    6⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    PID:2976
                                                                                                  • C:\Users\Admin\Documents\backup.exe
                                                                                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • System policy modification
                                                                                                    PID:928
                                                                                                  • C:\Users\Admin\Downloads\System Restore.exe
                                                                                                    "C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • System policy modification
                                                                                                    PID:2248
                                                                                                  • C:\Users\Admin\Favorites\backup.exe
                                                                                                    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                    6⤵
                                                                                                      PID:516
                                                                                                    • C:\Users\Admin\Links\backup.exe
                                                                                                      C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                      6⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • System policy modification
                                                                                                      PID:4696
                                                                                                    • C:\Users\Admin\Music\backup.exe
                                                                                                      C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                      6⤵
                                                                                                        PID:2824
                                                                                                      • C:\Users\Admin\OneDrive\backup.exe
                                                                                                        C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                        6⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • System policy modification
                                                                                                        PID:2152
                                                                                                      • C:\Users\Admin\Pictures\backup.exe
                                                                                                        C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                        6⤵
                                                                                                          PID:388
                                                                                                    • C:\Windows\backup.exe
                                                                                                      C:\Windows\backup.exe C:\Windows\
                                                                                                      4⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • Drops file in Windows directory
                                                                                                      • System policy modification
                                                                                                      PID:4304
                                                                                                      • C:\Windows\addins\backup.exe
                                                                                                        C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                        5⤵
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        PID:3560
                                                                                                      • C:\Windows\appcompat\backup.exe
                                                                                                        C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                        5⤵
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:1344
                                                                                                        • C:\Windows\appcompat\appraiser\update.exe
                                                                                                          C:\Windows\appcompat\appraiser\update.exe C:\Windows\appcompat\appraiser\
                                                                                                          6⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:4444
                                                                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:3876
                                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:64
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\update.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\Low\update.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:4796
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:3392
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                  2⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:3260
                                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:4420

                                                                                              Network

                                                                                              MITRE ATT&CK Enterprise v6

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              • C:\PerfLogs\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                b6aac8c27b00aa9316c174bb655dd335

                                                                                                SHA1

                                                                                                041cc779b57f082feef639e0f825fa17910bd5dc

                                                                                                SHA256

                                                                                                6958aa422372226cca96353d2b0c88f4f205d6e133114e9fe677c3a23e3ab5a0

                                                                                                SHA512

                                                                                                a3cf355e2ba324b8fb9ddce8733d90b3b1e44c1855ab8ac6e7b80b648ad2ae762afa4398f433aeb803f2da6db7179f8342efd0989724e3b576ffef82ff3a7e61

                                                                                              • C:\PerfLogs\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                b6aac8c27b00aa9316c174bb655dd335

                                                                                                SHA1

                                                                                                041cc779b57f082feef639e0f825fa17910bd5dc

                                                                                                SHA256

                                                                                                6958aa422372226cca96353d2b0c88f4f205d6e133114e9fe677c3a23e3ab5a0

                                                                                                SHA512

                                                                                                a3cf355e2ba324b8fb9ddce8733d90b3b1e44c1855ab8ac6e7b80b648ad2ae762afa4398f433aeb803f2da6db7179f8342efd0989724e3b576ffef82ff3a7e61

                                                                                              • C:\Program Files (x86)\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                86557df98b6e43b1fc147e2404faf8e6

                                                                                                SHA1

                                                                                                4cbf0e183bad0150f71f210a920e3e514037d6a5

                                                                                                SHA256

                                                                                                f5bc0a6121df731b90fe405265a821ccffeab17c1818419d8deb24a013fe31df

                                                                                                SHA512

                                                                                                8df2ed9877642f7495b3b988c8d6ef398d54d45227dba3837e07edf84241fa09ff651c937e19932b8ff595f4c9ac8b4a6a89e8fcb23203d11542905da744cbb5

                                                                                              • C:\Program Files (x86)\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                86557df98b6e43b1fc147e2404faf8e6

                                                                                                SHA1

                                                                                                4cbf0e183bad0150f71f210a920e3e514037d6a5

                                                                                                SHA256

                                                                                                f5bc0a6121df731b90fe405265a821ccffeab17c1818419d8deb24a013fe31df

                                                                                                SHA512

                                                                                                8df2ed9877642f7495b3b988c8d6ef398d54d45227dba3837e07edf84241fa09ff651c937e19932b8ff595f4c9ac8b4a6a89e8fcb23203d11542905da744cbb5

                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                85835878f51dfd93b7e336a0f43ab9e6

                                                                                                SHA1

                                                                                                c932f4e74267c47f196c057955dbfa63eb5b4b32

                                                                                                SHA256

                                                                                                95ecee343d6b0e86fda984bb2222b83aa6f24a23cf32c5a14708bafcf4bdb7d4

                                                                                                SHA512

                                                                                                ad9dcb2e7c01f2628098b6ba68bc7f85092e6817c1babe6a6c371df602a917a2aa0244ec96f95c3486c6ce83d38e7d26f6dc531e4d61ac471102547cdb0cb0a6

                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                85835878f51dfd93b7e336a0f43ab9e6

                                                                                                SHA1

                                                                                                c932f4e74267c47f196c057955dbfa63eb5b4b32

                                                                                                SHA256

                                                                                                95ecee343d6b0e86fda984bb2222b83aa6f24a23cf32c5a14708bafcf4bdb7d4

                                                                                                SHA512

                                                                                                ad9dcb2e7c01f2628098b6ba68bc7f85092e6817c1babe6a6c371df602a917a2aa0244ec96f95c3486c6ce83d38e7d26f6dc531e4d61ac471102547cdb0cb0a6

                                                                                              • C:\Program Files\7-Zip\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                6013817abe5dd6b9493cc6880a2c37d5

                                                                                                SHA1

                                                                                                4880fd16fd1a5723c8d1fe3fa588c57d4f6fe34d

                                                                                                SHA256

                                                                                                1b06f74483fe107a3feca5757ebce33c6e7a9142b6c3f21cdbd1b1d331d7ebf2

                                                                                                SHA512

                                                                                                d79c7b80456caf7d249f4a4c3760965b3dd6731a46a0261f915080385b432e141464ea28b02447ed338f02d58a947b78f2e28da40bd2636688c4327abece75a2

                                                                                              • C:\Program Files\7-Zip\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                6013817abe5dd6b9493cc6880a2c37d5

                                                                                                SHA1

                                                                                                4880fd16fd1a5723c8d1fe3fa588c57d4f6fe34d

                                                                                                SHA256

                                                                                                1b06f74483fe107a3feca5757ebce33c6e7a9142b6c3f21cdbd1b1d331d7ebf2

                                                                                                SHA512

                                                                                                d79c7b80456caf7d249f4a4c3760965b3dd6731a46a0261f915080385b432e141464ea28b02447ed338f02d58a947b78f2e28da40bd2636688c4327abece75a2

                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                36ad02ea05488eac47c5b06d4a51ad6c

                                                                                                SHA1

                                                                                                9f2a1c96d2075b9b44c46108c1586f5fefc1b1dc

                                                                                                SHA256

                                                                                                d3323923117c0b323dba98d1c607515dd97fc0453e66f0743247e340d5a7c8f4

                                                                                                SHA512

                                                                                                7eb3dafcad2fcd98031a8c350ba8332b66587fde87152cf5731766135eca68eca4c2654f5133586ab33b02deb5aa15b785d74d517098e9f20ba1d9a4c5957bbd

                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                36ad02ea05488eac47c5b06d4a51ad6c

                                                                                                SHA1

                                                                                                9f2a1c96d2075b9b44c46108c1586f5fefc1b1dc

                                                                                                SHA256

                                                                                                d3323923117c0b323dba98d1c607515dd97fc0453e66f0743247e340d5a7c8f4

                                                                                                SHA512

                                                                                                7eb3dafcad2fcd98031a8c350ba8332b66587fde87152cf5731766135eca68eca4c2654f5133586ab33b02deb5aa15b785d74d517098e9f20ba1d9a4c5957bbd

                                                                                              • C:\Program Files\Common Files\Services\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                1835f8339bcd867eae5c4a43f4d9d5f6

                                                                                                SHA1

                                                                                                3ffb206c72789fdaf3dd0644c4f8507fd39c788c

                                                                                                SHA256

                                                                                                6a72ee51fb67094218710d03c28767772290fa06fae1504b6f62db61cd72d053

                                                                                                SHA512

                                                                                                fd763f24641e5d50024c9f4aa01644cb0aaec948c3192ae972fdb3c963f9c5182dcbc4e19357dcca26c7b2da9c4718bfa8302878a72000f4df921afac61c2225

                                                                                              • C:\Program Files\Common Files\Services\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                1835f8339bcd867eae5c4a43f4d9d5f6

                                                                                                SHA1

                                                                                                3ffb206c72789fdaf3dd0644c4f8507fd39c788c

                                                                                                SHA256

                                                                                                6a72ee51fb67094218710d03c28767772290fa06fae1504b6f62db61cd72d053

                                                                                                SHA512

                                                                                                fd763f24641e5d50024c9f4aa01644cb0aaec948c3192ae972fdb3c963f9c5182dcbc4e19357dcca26c7b2da9c4718bfa8302878a72000f4df921afac61c2225

                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                f282eb6ecfb212cde44dd3b77ce3718e

                                                                                                SHA1

                                                                                                545af6bfb7839e59cc3aa186ad657096c10ca65c

                                                                                                SHA256

                                                                                                dcc6aca42a4b7a6cfe3f3969202d8ee78818faccd348012560fe2b7be05ad4e1

                                                                                                SHA512

                                                                                                4f6558810923e3f91efd2671152c1fd1fd39168a1402c5039afeb593468792e078cd5d7f842382305a6188c216082d93fbf63ec51f43bf137c3c08727964a982

                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                f282eb6ecfb212cde44dd3b77ce3718e

                                                                                                SHA1

                                                                                                545af6bfb7839e59cc3aa186ad657096c10ca65c

                                                                                                SHA256

                                                                                                dcc6aca42a4b7a6cfe3f3969202d8ee78818faccd348012560fe2b7be05ad4e1

                                                                                                SHA512

                                                                                                4f6558810923e3f91efd2671152c1fd1fd39168a1402c5039afeb593468792e078cd5d7f842382305a6188c216082d93fbf63ec51f43bf137c3c08727964a982

                                                                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                8b965913f5068f17bb92d67ca5a73995

                                                                                                SHA1

                                                                                                d9fd43c410b0deeffc51a22bbdba4a5de6630bbb

                                                                                                SHA256

                                                                                                e432d8eb4a132b3c8d655ed0359b992da93daeeada41d3014ed7f6fd17397c36

                                                                                                SHA512

                                                                                                d6ba7d1f731532b8975da99f623f602549f2534a8be43d76d085493d49b0a471fb4c6a4f60d3fef1172224578017ad7ac042cf2846d6fd07eaedaaafe7d808bc

                                                                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                8b965913f5068f17bb92d67ca5a73995

                                                                                                SHA1

                                                                                                d9fd43c410b0deeffc51a22bbdba4a5de6630bbb

                                                                                                SHA256

                                                                                                e432d8eb4a132b3c8d655ed0359b992da93daeeada41d3014ed7f6fd17397c36

                                                                                                SHA512

                                                                                                d6ba7d1f731532b8975da99f623f602549f2534a8be43d76d085493d49b0a471fb4c6a4f60d3fef1172224578017ad7ac042cf2846d6fd07eaedaaafe7d808bc

                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                36ad02ea05488eac47c5b06d4a51ad6c

                                                                                                SHA1

                                                                                                9f2a1c96d2075b9b44c46108c1586f5fefc1b1dc

                                                                                                SHA256

                                                                                                d3323923117c0b323dba98d1c607515dd97fc0453e66f0743247e340d5a7c8f4

                                                                                                SHA512

                                                                                                7eb3dafcad2fcd98031a8c350ba8332b66587fde87152cf5731766135eca68eca4c2654f5133586ab33b02deb5aa15b785d74d517098e9f20ba1d9a4c5957bbd

                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                36ad02ea05488eac47c5b06d4a51ad6c

                                                                                                SHA1

                                                                                                9f2a1c96d2075b9b44c46108c1586f5fefc1b1dc

                                                                                                SHA256

                                                                                                d3323923117c0b323dba98d1c607515dd97fc0453e66f0743247e340d5a7c8f4

                                                                                                SHA512

                                                                                                7eb3dafcad2fcd98031a8c350ba8332b66587fde87152cf5731766135eca68eca4c2654f5133586ab33b02deb5aa15b785d74d517098e9f20ba1d9a4c5957bbd

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                f282eb6ecfb212cde44dd3b77ce3718e

                                                                                                SHA1

                                                                                                545af6bfb7839e59cc3aa186ad657096c10ca65c

                                                                                                SHA256

                                                                                                dcc6aca42a4b7a6cfe3f3969202d8ee78818faccd348012560fe2b7be05ad4e1

                                                                                                SHA512

                                                                                                4f6558810923e3f91efd2671152c1fd1fd39168a1402c5039afeb593468792e078cd5d7f842382305a6188c216082d93fbf63ec51f43bf137c3c08727964a982

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                f282eb6ecfb212cde44dd3b77ce3718e

                                                                                                SHA1

                                                                                                545af6bfb7839e59cc3aa186ad657096c10ca65c

                                                                                                SHA256

                                                                                                dcc6aca42a4b7a6cfe3f3969202d8ee78818faccd348012560fe2b7be05ad4e1

                                                                                                SHA512

                                                                                                4f6558810923e3f91efd2671152c1fd1fd39168a1402c5039afeb593468792e078cd5d7f842382305a6188c216082d93fbf63ec51f43bf137c3c08727964a982

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                26e8228cd5502961b874b86b9edda772

                                                                                                SHA1

                                                                                                d87b17500541d3753bd3cdbf4467a49adeb71e23

                                                                                                SHA256

                                                                                                ce6cd20f76b139a3521ac09fc584cdbe2b2a69c4507d1feb68fc5aa8c9121a27

                                                                                                SHA512

                                                                                                0982c6de90bd0f50a58bf9ab7904f60c1f6af42ca30eb183d19f59e28dff72df37cf90e9f9b28ca61fe22a73239d2937551f9a3e1c501ec731dfc3601634aee6

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                78d701bc88458683f9708a3bbdbbfebd

                                                                                                SHA1

                                                                                                14fe52271cb48ca88898d8b30ecaca05aa55359c

                                                                                                SHA256

                                                                                                154a3e71a856efe2a71b0bc5f12166db59fa6d60f8faaeed1f8d64fbad3b55df

                                                                                                SHA512

                                                                                                2f54a1cb4f9c3f048ca4c7e67dad9d52fd2a92d6a799bc367a9e98ebdf405fc6c0725e57ab45dd41ee42c817420e9dbca3db30fb81c7aa72546ed4b80fcf6260

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                78d701bc88458683f9708a3bbdbbfebd

                                                                                                SHA1

                                                                                                14fe52271cb48ca88898d8b30ecaca05aa55359c

                                                                                                SHA256

                                                                                                154a3e71a856efe2a71b0bc5f12166db59fa6d60f8faaeed1f8d64fbad3b55df

                                                                                                SHA512

                                                                                                2f54a1cb4f9c3f048ca4c7e67dad9d52fd2a92d6a799bc367a9e98ebdf405fc6c0725e57ab45dd41ee42c817420e9dbca3db30fb81c7aa72546ed4b80fcf6260

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                78d701bc88458683f9708a3bbdbbfebd

                                                                                                SHA1

                                                                                                14fe52271cb48ca88898d8b30ecaca05aa55359c

                                                                                                SHA256

                                                                                                154a3e71a856efe2a71b0bc5f12166db59fa6d60f8faaeed1f8d64fbad3b55df

                                                                                                SHA512

                                                                                                2f54a1cb4f9c3f048ca4c7e67dad9d52fd2a92d6a799bc367a9e98ebdf405fc6c0725e57ab45dd41ee42c817420e9dbca3db30fb81c7aa72546ed4b80fcf6260

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                78d701bc88458683f9708a3bbdbbfebd

                                                                                                SHA1

                                                                                                14fe52271cb48ca88898d8b30ecaca05aa55359c

                                                                                                SHA256

                                                                                                154a3e71a856efe2a71b0bc5f12166db59fa6d60f8faaeed1f8d64fbad3b55df

                                                                                                SHA512

                                                                                                2f54a1cb4f9c3f048ca4c7e67dad9d52fd2a92d6a799bc367a9e98ebdf405fc6c0725e57ab45dd41ee42c817420e9dbca3db30fb81c7aa72546ed4b80fcf6260

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                78d701bc88458683f9708a3bbdbbfebd

                                                                                                SHA1

                                                                                                14fe52271cb48ca88898d8b30ecaca05aa55359c

                                                                                                SHA256

                                                                                                154a3e71a856efe2a71b0bc5f12166db59fa6d60f8faaeed1f8d64fbad3b55df

                                                                                                SHA512

                                                                                                2f54a1cb4f9c3f048ca4c7e67dad9d52fd2a92d6a799bc367a9e98ebdf405fc6c0725e57ab45dd41ee42c817420e9dbca3db30fb81c7aa72546ed4b80fcf6260

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                78d701bc88458683f9708a3bbdbbfebd

                                                                                                SHA1

                                                                                                14fe52271cb48ca88898d8b30ecaca05aa55359c

                                                                                                SHA256

                                                                                                154a3e71a856efe2a71b0bc5f12166db59fa6d60f8faaeed1f8d64fbad3b55df

                                                                                                SHA512

                                                                                                2f54a1cb4f9c3f048ca4c7e67dad9d52fd2a92d6a799bc367a9e98ebdf405fc6c0725e57ab45dd41ee42c817420e9dbca3db30fb81c7aa72546ed4b80fcf6260

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                78d701bc88458683f9708a3bbdbbfebd

                                                                                                SHA1

                                                                                                14fe52271cb48ca88898d8b30ecaca05aa55359c

                                                                                                SHA256

                                                                                                154a3e71a856efe2a71b0bc5f12166db59fa6d60f8faaeed1f8d64fbad3b55df

                                                                                                SHA512

                                                                                                2f54a1cb4f9c3f048ca4c7e67dad9d52fd2a92d6a799bc367a9e98ebdf405fc6c0725e57ab45dd41ee42c817420e9dbca3db30fb81c7aa72546ed4b80fcf6260

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                78d701bc88458683f9708a3bbdbbfebd

                                                                                                SHA1

                                                                                                14fe52271cb48ca88898d8b30ecaca05aa55359c

                                                                                                SHA256

                                                                                                154a3e71a856efe2a71b0bc5f12166db59fa6d60f8faaeed1f8d64fbad3b55df

                                                                                                SHA512

                                                                                                2f54a1cb4f9c3f048ca4c7e67dad9d52fd2a92d6a799bc367a9e98ebdf405fc6c0725e57ab45dd41ee42c817420e9dbca3db30fb81c7aa72546ed4b80fcf6260

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                598c0d0e42aad9c76511216515b4a76f

                                                                                                SHA1

                                                                                                a4d6d1f62be482d0dc88a3b0999bfeac27f18827

                                                                                                SHA256

                                                                                                6eaff7821554617f3e9270b5486b7951f74809f5b77069e14dcd7f78473095b7

                                                                                                SHA512

                                                                                                daff8e38c5a76e737751a50698ab7199e7def9f3a2c1adb666353508c1fa8a34d44e7d7a826c5222abfa756bc202ace3cdca183bba2d7103b8e3e4c2109e8c8a

                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                598c0d0e42aad9c76511216515b4a76f

                                                                                                SHA1

                                                                                                a4d6d1f62be482d0dc88a3b0999bfeac27f18827

                                                                                                SHA256

                                                                                                6eaff7821554617f3e9270b5486b7951f74809f5b77069e14dcd7f78473095b7

                                                                                                SHA512

                                                                                                daff8e38c5a76e737751a50698ab7199e7def9f3a2c1adb666353508c1fa8a34d44e7d7a826c5222abfa756bc202ace3cdca183bba2d7103b8e3e4c2109e8c8a

                                                                                              • C:\Program Files\Common Files\update.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                af23e360ed3c1a25e899aa06ece49b22

                                                                                                SHA1

                                                                                                342813f6bb5de2db83063ca56a9ca00b26c028d8

                                                                                                SHA256

                                                                                                48bd8a686bda119b77404ae7f4954e855c4f3dcf5057f51200d81bb4601d3e60

                                                                                                SHA512

                                                                                                f65e3ede548587107403329e7a965b27ff6becfeed55a81c1ecd2f3c71f26e0d43a009ec287e509d0a50fec12abed84f875b4798f5a5c93d25ca5633c4b30577

                                                                                              • C:\Program Files\Common Files\update.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                af23e360ed3c1a25e899aa06ece49b22

                                                                                                SHA1

                                                                                                342813f6bb5de2db83063ca56a9ca00b26c028d8

                                                                                                SHA256

                                                                                                48bd8a686bda119b77404ae7f4954e855c4f3dcf5057f51200d81bb4601d3e60

                                                                                                SHA512

                                                                                                f65e3ede548587107403329e7a965b27ff6becfeed55a81c1ecd2f3c71f26e0d43a009ec287e509d0a50fec12abed84f875b4798f5a5c93d25ca5633c4b30577

                                                                                              • C:\Program Files\Google\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                a4b84cae8816e168d95d8d6345825f45

                                                                                                SHA1

                                                                                                4dbf7cdfd14a60a1c40ab88296bcf3a72f570579

                                                                                                SHA256

                                                                                                44dc979af4236c2b6f7eeb1a79acd582fa138fce8b9205b81dfd102cc3fb7ebf

                                                                                                SHA512

                                                                                                b1539f368d77803aee25e8144cc5b744740c2c1572386b4dd7bbfbf5e8de34458da13ffe1fcbba7face85e2548d3316af480815a5c261e31d99909b87f0d330c

                                                                                              • C:\Program Files\Google\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                a4b84cae8816e168d95d8d6345825f45

                                                                                                SHA1

                                                                                                4dbf7cdfd14a60a1c40ab88296bcf3a72f570579

                                                                                                SHA256

                                                                                                44dc979af4236c2b6f7eeb1a79acd582fa138fce8b9205b81dfd102cc3fb7ebf

                                                                                                SHA512

                                                                                                b1539f368d77803aee25e8144cc5b744740c2c1572386b4dd7bbfbf5e8de34458da13ffe1fcbba7face85e2548d3316af480815a5c261e31d99909b87f0d330c

                                                                                              • C:\Program Files\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                b6aac8c27b00aa9316c174bb655dd335

                                                                                                SHA1

                                                                                                041cc779b57f082feef639e0f825fa17910bd5dc

                                                                                                SHA256

                                                                                                6958aa422372226cca96353d2b0c88f4f205d6e133114e9fe677c3a23e3ab5a0

                                                                                                SHA512

                                                                                                a3cf355e2ba324b8fb9ddce8733d90b3b1e44c1855ab8ac6e7b80b648ad2ae762afa4398f433aeb803f2da6db7179f8342efd0989724e3b576ffef82ff3a7e61

                                                                                              • C:\Program Files\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                b6aac8c27b00aa9316c174bb655dd335

                                                                                                SHA1

                                                                                                041cc779b57f082feef639e0f825fa17910bd5dc

                                                                                                SHA256

                                                                                                6958aa422372226cca96353d2b0c88f4f205d6e133114e9fe677c3a23e3ab5a0

                                                                                                SHA512

                                                                                                a3cf355e2ba324b8fb9ddce8733d90b3b1e44c1855ab8ac6e7b80b648ad2ae762afa4398f433aeb803f2da6db7179f8342efd0989724e3b576ffef82ff3a7e61

                                                                                              • C:\System Restore.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                a12aa1c670de96719462a94bae05256e

                                                                                                SHA1

                                                                                                0cdd6ef47698a11e883755c58f3dd4e48a0cf1b7

                                                                                                SHA256

                                                                                                e76f9fe582089a1401f40b4cc11e576caa0c964a9b73c36c2557b38e30283bd5

                                                                                                SHA512

                                                                                                452ce57fca86363634672c2b3825143a23bc51108a27d71bcdf05d74de712a4ea5ffc1373c798a1383f69116ff723fb93b6e5151ae167260bb633efd751add12

                                                                                              • C:\System Restore.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                a12aa1c670de96719462a94bae05256e

                                                                                                SHA1

                                                                                                0cdd6ef47698a11e883755c58f3dd4e48a0cf1b7

                                                                                                SHA256

                                                                                                e76f9fe582089a1401f40b4cc11e576caa0c964a9b73c36c2557b38e30283bd5

                                                                                                SHA512

                                                                                                452ce57fca86363634672c2b3825143a23bc51108a27d71bcdf05d74de712a4ea5ffc1373c798a1383f69116ff723fb93b6e5151ae167260bb633efd751add12

                                                                                              • C:\Users\Admin\AppData\Local\Temp\3817019113\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                afc13d80f8b6ad8b7e2d029e5e456d97

                                                                                                SHA1

                                                                                                e04e39b518355c704ca649ca57065667766a6cab

                                                                                                SHA256

                                                                                                6034b6d09c109b3cd1429a5346aab5e0e4e836a27f9276b70a24149c797731d4

                                                                                                SHA512

                                                                                                4333cafb623ccce27a18babe5f9a454228828efea5b327b09dada2d8707a3c653b1972bbd9a410913bdd5ae0060404d98bb65f6e954aad48f8ca760b651f6be9

                                                                                              • C:\Users\Admin\AppData\Local\Temp\3817019113\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                afc13d80f8b6ad8b7e2d029e5e456d97

                                                                                                SHA1

                                                                                                e04e39b518355c704ca649ca57065667766a6cab

                                                                                                SHA256

                                                                                                6034b6d09c109b3cd1429a5346aab5e0e4e836a27f9276b70a24149c797731d4

                                                                                                SHA512

                                                                                                4333cafb623ccce27a18babe5f9a454228828efea5b327b09dada2d8707a3c653b1972bbd9a410913bdd5ae0060404d98bb65f6e954aad48f8ca760b651f6be9

                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\update.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                753003e8f461b843495dc13c0b8cdfa1

                                                                                                SHA1

                                                                                                dd8fc1d322ac5b7bf7a05dc85b80bac921652d21

                                                                                                SHA256

                                                                                                2f2feb2290d786b463076837ee8a93cb0161ad3dd6547b77bd3df15affc9e258

                                                                                                SHA512

                                                                                                a33223af613980caea8a1c05c55dfcdc67d7c916fb1ad4d97d83dc6b81644e3cc342212ede62c2f595f4cc48ff7a32fd239cb7e582e7498c57adbf178155e230

                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\update.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                753003e8f461b843495dc13c0b8cdfa1

                                                                                                SHA1

                                                                                                dd8fc1d322ac5b7bf7a05dc85b80bac921652d21

                                                                                                SHA256

                                                                                                2f2feb2290d786b463076837ee8a93cb0161ad3dd6547b77bd3df15affc9e258

                                                                                                SHA512

                                                                                                a33223af613980caea8a1c05c55dfcdc67d7c916fb1ad4d97d83dc6b81644e3cc342212ede62c2f595f4cc48ff7a32fd239cb7e582e7498c57adbf178155e230

                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                d8539c4ffbc2a57384f887a753f9b1d0

                                                                                                SHA1

                                                                                                fc0f141e4b6672a432fd2ead79f530350dd76a38

                                                                                                SHA256

                                                                                                b38332578e43c0a1e592d511117d82a50a8a0108d077795410cf2a0a08f23de1

                                                                                                SHA512

                                                                                                cd0cab2b74c3bf90d8c8a530149adfdf197b349adfd6280a0b2b411319cef790784d2cfcb4b7e1f593a2e9f0dcb20487b5079ec6fa5622b1ab4713ea25b7018e

                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                d8539c4ffbc2a57384f887a753f9b1d0

                                                                                                SHA1

                                                                                                fc0f141e4b6672a432fd2ead79f530350dd76a38

                                                                                                SHA256

                                                                                                b38332578e43c0a1e592d511117d82a50a8a0108d077795410cf2a0a08f23de1

                                                                                                SHA512

                                                                                                cd0cab2b74c3bf90d8c8a530149adfdf197b349adfd6280a0b2b411319cef790784d2cfcb4b7e1f593a2e9f0dcb20487b5079ec6fa5622b1ab4713ea25b7018e

                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                d8539c4ffbc2a57384f887a753f9b1d0

                                                                                                SHA1

                                                                                                fc0f141e4b6672a432fd2ead79f530350dd76a38

                                                                                                SHA256

                                                                                                b38332578e43c0a1e592d511117d82a50a8a0108d077795410cf2a0a08f23de1

                                                                                                SHA512

                                                                                                cd0cab2b74c3bf90d8c8a530149adfdf197b349adfd6280a0b2b411319cef790784d2cfcb4b7e1f593a2e9f0dcb20487b5079ec6fa5622b1ab4713ea25b7018e

                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                d8539c4ffbc2a57384f887a753f9b1d0

                                                                                                SHA1

                                                                                                fc0f141e4b6672a432fd2ead79f530350dd76a38

                                                                                                SHA256

                                                                                                b38332578e43c0a1e592d511117d82a50a8a0108d077795410cf2a0a08f23de1

                                                                                                SHA512

                                                                                                cd0cab2b74c3bf90d8c8a530149adfdf197b349adfd6280a0b2b411319cef790784d2cfcb4b7e1f593a2e9f0dcb20487b5079ec6fa5622b1ab4713ea25b7018e

                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                918a4ee873c19a5906ed8fd0184674be

                                                                                                SHA1

                                                                                                a9420c91a809636853401c8e395ce74e3fc1007b

                                                                                                SHA256

                                                                                                49174e60741ad93e1e77b5f5b807014117b3e94b196763547d141bf4efcf9f90

                                                                                                SHA512

                                                                                                482b5052a428069a0de4c5e00d89462b27d754fbb37a1c40e4addb81bddabb3d7ba27ee360763db930e24a6e4905b48a2a6dd2869e42c75a581401736345ea92

                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                918a4ee873c19a5906ed8fd0184674be

                                                                                                SHA1

                                                                                                a9420c91a809636853401c8e395ce74e3fc1007b

                                                                                                SHA256

                                                                                                49174e60741ad93e1e77b5f5b807014117b3e94b196763547d141bf4efcf9f90

                                                                                                SHA512

                                                                                                482b5052a428069a0de4c5e00d89462b27d754fbb37a1c40e4addb81bddabb3d7ba27ee360763db930e24a6e4905b48a2a6dd2869e42c75a581401736345ea92

                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                918a4ee873c19a5906ed8fd0184674be

                                                                                                SHA1

                                                                                                a9420c91a809636853401c8e395ce74e3fc1007b

                                                                                                SHA256

                                                                                                49174e60741ad93e1e77b5f5b807014117b3e94b196763547d141bf4efcf9f90

                                                                                                SHA512

                                                                                                482b5052a428069a0de4c5e00d89462b27d754fbb37a1c40e4addb81bddabb3d7ba27ee360763db930e24a6e4905b48a2a6dd2869e42c75a581401736345ea92

                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                918a4ee873c19a5906ed8fd0184674be

                                                                                                SHA1

                                                                                                a9420c91a809636853401c8e395ce74e3fc1007b

                                                                                                SHA256

                                                                                                49174e60741ad93e1e77b5f5b807014117b3e94b196763547d141bf4efcf9f90

                                                                                                SHA512

                                                                                                482b5052a428069a0de4c5e00d89462b27d754fbb37a1c40e4addb81bddabb3d7ba27ee360763db930e24a6e4905b48a2a6dd2869e42c75a581401736345ea92

                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                605bd786e28dc55606d35fd92364d97a

                                                                                                SHA1

                                                                                                9e17774c8505cd2f1a755ee8d82f38089f7e88df

                                                                                                SHA256

                                                                                                672137a28b1b5ee6d0681badec4ea9d5c25432d24ee523893506067097102bd3

                                                                                                SHA512

                                                                                                e5b98b65b78540d35e6b9153e44ff84fd52c70143f7b0ae2adcf2cb840f1165ba56e81c47f4ced26191f494270d6eda3047273eea2610dc6b7224f556ac83196

                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                605bd786e28dc55606d35fd92364d97a

                                                                                                SHA1

                                                                                                9e17774c8505cd2f1a755ee8d82f38089f7e88df

                                                                                                SHA256

                                                                                                672137a28b1b5ee6d0681badec4ea9d5c25432d24ee523893506067097102bd3

                                                                                                SHA512

                                                                                                e5b98b65b78540d35e6b9153e44ff84fd52c70143f7b0ae2adcf2cb840f1165ba56e81c47f4ced26191f494270d6eda3047273eea2610dc6b7224f556ac83196

                                                                                              • C:\odt\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                b6aac8c27b00aa9316c174bb655dd335

                                                                                                SHA1

                                                                                                041cc779b57f082feef639e0f825fa17910bd5dc

                                                                                                SHA256

                                                                                                6958aa422372226cca96353d2b0c88f4f205d6e133114e9fe677c3a23e3ab5a0

                                                                                                SHA512

                                                                                                a3cf355e2ba324b8fb9ddce8733d90b3b1e44c1855ab8ac6e7b80b648ad2ae762afa4398f433aeb803f2da6db7179f8342efd0989724e3b576ffef82ff3a7e61

                                                                                              • C:\odt\backup.exe

                                                                                                Filesize

                                                                                                72KB

                                                                                                MD5

                                                                                                b6aac8c27b00aa9316c174bb655dd335

                                                                                                SHA1

                                                                                                041cc779b57f082feef639e0f825fa17910bd5dc

                                                                                                SHA256

                                                                                                6958aa422372226cca96353d2b0c88f4f205d6e133114e9fe677c3a23e3ab5a0

                                                                                                SHA512

                                                                                                a3cf355e2ba324b8fb9ddce8733d90b3b1e44c1855ab8ac6e7b80b648ad2ae762afa4398f433aeb803f2da6db7179f8342efd0989724e3b576ffef82ff3a7e61